Skills workflow-automation
📦

workflow-automation

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Automate Development Workflows

Teams lose time repeating setup, build, test, and deployment commands. This skill creates practical workflow templates for npm, Make, hooks, scripts, and CI.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "workflow-automation" from https://skillstore.io/skills/supercent-io-workflow-automation.md and its manifest at https://skillstore.io/api/skills/supercent-io-workflow-automation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/supercent-io-workflow-automation.md Signed manifest GET /api/skills/supercent-io-workflow-automation/manifest Signed lockfile GET /api/skills/supercent-io-workflow-automation/lockfile

Test it

Using "workflow-automation". Create workflow automation for a new TypeScript service.

Expected outcome:

A structured plan with npm tasks, Make targets, pre-commit checks, setup steps, and CI validation stages.

Using "workflow-automation". Help our team standardize pull request checks.

Expected outcome:

A workflow outline covering linting, formatting, type checks, tests, coverage upload, and branch-based CI triggers.

Using "workflow-automation". Prepare deployment automation for staging and production.

Expected outcome:

A deployment script design with build, test, environment selection, remote command review, and confirmation safeguards.

Security Audit

High Risk
v5 • 7/7/2026 Open versioned report

The static findings are false positives for Markdown code fences, documentation links, /dev/null redirects, and guarded .env template creation. No prompt injection attempt was found. Semantic review identified operational risks from destructive cleanup examples, SSH deployment commands, and non-immutable third-party CI action pinning.

2
Files scanned
344
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (3)

High
SKILL.md:211-218
Remote Deployment Commands Target Production Hosts
The deployment example runs SSH commands against staging and production host aliases and restarts services. Copied without review, generated scripts could modify live systems.
The SSH deployment commands are explicit in the script example. The risk depends on user configuration, but the live-system impact is clear.
Medium
SKILL.md:37-38SKILL.md:74-75SKILL.md:289-292
Destructive Cleanup Commands Included
The skill shows cleanup tasks that remove directories with rm -rf, while later saying destructive commands should not run without confirmation. Generated workflows should require explicit approval before deleting files.
The removal commands and the safety rule are both present in SKILL.md. The commands target project-local paths, so the likely impact is moderate.
Medium
SKILL.md:261-262
Third-Party CI Action Is Not Pinned Immutably
The GitHub Actions example uses a third-party Codecov action by version tag rather than an immutable commit. This can increase supply chain risk in generated CI workflows.
The third-party action reference is visible in the workflow example. Tag pinning is common but weaker than commit pinning for supply chain control.

Risk Factors

⚙️ External commands (25)
SKILL.md:24-43 SKILL.md:43-48 SKILL.md:48-89 SKILL.md:89-92 SKILL.md:92-96 SKILL.md:96-101 SKILL.md:101-113 SKILL.md:113-116 SKILL.md:116-132 SKILL.md:132-137 SKILL.md:137-186 SKILL.md:186-189 SKILL.md:189-222 SKILL.md:222-227 SKILL.md:227-263 SKILL.md:263-267 SKILL.md:267-279 SKILL.md:279-314 SKILL.md:314 SKILL.md:54 SKILL.md:118 SKILL.md:48-89 SKILL.md:116-132 SKILL.md:138 SKILL.md:190
🌐 Network access (3)
SKILL.md:302 SKILL.md:303 SKILL.md:304
📁 Filesystem access (2)
SKILL.md:144 SKILL.md:149
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/supercent-io-workflow-automation/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/supercent-io-workflow-automation/security.svg)](https://skillstore.io/skills/supercent-io-workflow-automation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/supercent-io-workflow-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-workflow-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/supercent-io-workflow-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

supercent-io. (2026). workflow-automation security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/supercent-io-workflow-automation/audits/5

BibTeX citation

@techreport{supercent-io-supercent-io-workflow-automation-2026, author = {supercent-io}, title = {workflow-automation security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/supercent-io-workflow-automation/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "workflow-automation security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "supercent-io" date-released: "2026-07-07" url: "https://skillstore.io/skills/supercent-io-workflow-automation/audits/5" identifiers: - type: other value: "skillstore:supercent-io-workflow-automation:audit:5" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
sickn33 Recommended

sickn33-workflow-automation

Skillstore Score 78
Evidence Confidence High
Skillstore usage 9
Updated

2026-08-21

supercent-io Current

supercent-io-workflow-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Standardize Local Commands

Create npm scripts and Make targets so every developer runs the same build, test, lint, and setup commands.

Prepare Project Onboarding

Generate setup scripts and documented automation so new contributors can prepare a development environment faster.

Create CI Baselines

Draft GitHub Actions workflows that run validation checks for pull requests and main branch changes.

Try These Prompts

Create Basic Scripts 
Create npm scripts for a Node.js project with development, build, test, lint, format, and type check commands.
Add Make Targets 
Create a Makefile that wraps my npm scripts and includes help, install, dev, build, test, lint, clean, and ci targets.
Automate Quality Gates 
Set up Husky and lint-staged for a TypeScript project. Include checks for formatting, linting, type checking, and changed tests.
Design Full Workflow 
Design a complete workflow automation plan with setup scripts, safe cleanup, Docker commands, GitHub Actions CI, and reviewed deployment steps.

Best Practices

  • Review every generated command before running it locally or in CI.
  • Keep automation idempotent, project-scoped, and documented for team use.
  • Use confirmation prompts or dry-run modes for cleanup and deployment tasks.

Avoid

  • Do not run generated cleanup or deployment commands without checking their targets.
  • Do not hardcode secrets, tokens, passwords, or private host details in scripts.
  • Do not copy placeholder paths, service names, or hosts into production unchanged.

Frequently Asked Questions

What does this skill generate?
It generates workflow templates for npm scripts, Makefiles, Git hooks, shell scripts, Docker tasks, and GitHub Actions.
Can it run the automation for me?
No. It provides templates and guidance. Users should review commands before running them.
Is it only for Node.js projects?
Most examples target Node.js workflows, but the Makefile and script patterns can be adapted to other stacks.
Does it include deployment workflows?
Yes. It includes deployment script patterns, but real deployment commands need careful review and project-specific safeguards.
Can it create GitHub Actions workflows?
Yes. It can draft CI workflows for linting, type checks, tests, builds, and coverage upload.
How should teams use it safely?
Treat generated scripts as drafts, validate paths and hosts, remove secrets, and require confirmation for destructive actions.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/supercent-io/skills-template/tree/main/.agent-skills/workflow-automation/

Ref

36e07d5e13068e5be64447e8f20b427cf2cbd21a

Maintenance freshness

7/18/2026

Usage

10 downloads · 163 views

File structure

📄 SKILL.md

📄 SKILL.toon