Difference from a workflow
A post-script and a workflow step are both prompts with a declared output schema, but they run at different times, see different inputs, and do different jobs.
When they run
- Workflow steps run during the scan, chained across depths, to produce findings.
- Post-scripts run after the workflow - and after de-duplication and ranking - once per finding, to enrich each one.
What they can reference
This is the key difference. A workflow step can read built-ins, extra, and any earlier
depth's output. A post-script may only reference:
- the reserved context keys (scan inputs like
repo_full,commit_sha,repo_scope,dependencies,configuration,workspace_*, and per-scan values through{{extra.<key>}}), and - the finding keys (the vulnerability fields:
summary,vulnerability_type,file_path,line,explanation,trigger_flow,malicious_input_example,malicious_actor, and so on).
A post-script cannot read another step's or another post-script's output.
What they output
A post-script's output keys become columns on the finding's post_script_answer, so they
can't reuse a reserved context or finding key. Additional post-scripts store their output
as separate enrichments on the same finding.
| Workflow step | Post-script | |
|---|---|---|
| Runs | During the scan, per depth | After ranking, per finding |
| Purpose | Produce findings | Enrich findings |
| Can reference | Built-ins, extra, earlier depths | Reserved context, extra, finding keys |
| Output | Feeds the next depth | Columns on the finding |
Next: recommended usage.