webflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited webflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
WEBFLOW_API_TOKEN environment variableWEBFLOW_SITE_ID environment variableconst { WebflowClient } = require('webflow-api');
const fs = require('fs');
const client = new WebflowClient({
token: process.env.WEBFLOW_API_TOKEN
});
async function uploadAsset(filePath, fileName) {
const fileBuffer = fs.readFileSync(filePath);
const arrayBuffer = fileBuffer.buffer.slice(
fileBuffer.byteOffset,
fileBuffer.byteOffset + fileBuffer.byteLength
);
return await client.assets.utilities.createAndUpload(
process.env.WEBFLOW_SITE_ID,
{ file: arrayBuffer, fileName }
);
}⚠️ NOTE: The Personal Access Token may not have asset upload permissions (401 Unauthorized). If this fails, use Zernio workaround below.
# 1. Upload to Zernio
zernio media:upload /path/to/image.jpg
# Returns: {"url": "https://media.zernio.com/temp/..."}
# 2. Use the Zernio URL in Webflow PATCH
curl -X PATCH "https://api.webflow.com/v2/collections/<ID>/items/<ITEM_ID>" \
-H "Authorization: Bearer <TOKEN>" \
-H "Content-Type: application/json" \
-d '{"fieldData": {"cover": {"url": "https://media.zernio.com/temp/..."}}}'<COLLECTION_ID><COLLECTION_ID><COLLECTION_ID><COLLECTION_ID># List collections
curl -s "https://api.webflow.com/v2/sites/<SITE_ID>/collections" \
-H "Authorization: Bearer <TOKEN>"
# Get items
curl -s "https://api.webflow.com/v2/collections/<COLLECTION_ID>/items?limit=20" \
-H "Authorization: Bearer <TOKEN>"
# Update item (PATCH)
curl -s -X PATCH "https://api.webflow.com/v2/collections/<COLLECTION_ID>/items/<ITEM_ID>" \
-H "Authorization: Bearer <TOKEN>" \
-H "Content-Type: application/json" \
-d '{"fieldData": {"field-slug": "value"}}'
# Update image field
curl -s -X PATCH "https://api.webflow.com/v2/collections/<COLLECTION_ID>/items/<ITEM_ID>" \
-H "Authorization: Bearer <TOKEN>" \
-H "Content-Type: application/json" \
-d '{"fieldData": {"cover": {"url": "https://..."}}}'
# Publish site
curl -s -X POST "https://api.webflow.com/v2/sites/<SITE_ID>/publish" \
-H "Authorization: Bearer <TOKEN>" \
-H "Content-Type: application/json" \
-d '{}'| ID | Naam | City |
|---|---|---|
<ITEM_ID> | Stedelijk Museum Amsterdam | Amsterdam |
<ITEM_ID> | Collectie Gelderland | Arnhem |
<ITEM_ID> | Fries Museum | Leeuwarden |
<ITEM_ID> | Museum Boijmans Van Beuningen | Rotterdam |
<ITEM_ID> | Museum De Lakenhal | Leiden |
<ITEM_ID> | SCHUNCK | Heerlen |
<ITEM_ID> | Museum Het Valkhof | Nijmegen |
<ITEM_ID> | Rijksmuseum Twenthe | Enschede |
<ITEM_ID> | Stedelijk Museum Schiedam | Schiedam |
<ITEM_ID> | TextielMuseum | Tilburg |
<ITEM_ID> | Museum Het Domein | Sittard |
| ID | Naam | Gallery | Date |
|---|---|---|---|
<ITEM_ID> | Heem | Fries Museum | 28 Apr 2024 – 27 Apr 2025 |
<ITEM_ID> | 33 1/3 RPM | De Vishal | 7 Sep – 13 Oct 2024 |
<ITEM_ID> | Copilot, Voice and Vision | Galerie Fons Welters | 2 Nov – 21 Dec 2024 |
<ITEM_ID> | Connecting Threads | GPS Gallery | 9 Jan – 17 Jan 2026 |
<ITEM_ID> | Art Rotterdam 2026 | Rotterdam Ahoy | 27 – 29 Mar 2026 |
{"url": "..."} format, not plain URL string~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.