workflow-schema-tuning — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-schema-tuning (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The schema (resources/workflow-schema.json) is the primary spec delivered to the AI editor at runtime via the get_workflow_schema MCP tool. It is not a runtime validator — the runtime barely validates anything. Whatever the schema says, the AI believes. Treat schema edits as prompt engineering, not type definitions.
AI agents already know how to choose between node types intuitively (e.g., when to delegate to a sub-agent vs. handle in-context). The fix for bad output is almost never "add more rules" — it is "remove what is biasing the AI in the wrong direction."
Defaults:
aiGenerationGuidance lists of "when to use / when not to use / anti-patterns." They treat the AI as a rules engine, bloat tokens, and fail on unanticipated cases.Anti-pattern: writing detailed upgradeToSubAgentWhen / stayInPromptWhen lists. If you find yourself writing 3+ bullets explaining when to use a node, the description itself is probably wrong.
| File | Role | Editable? |
|---|---|---|
resources/workflow-schema.json | Single source of truth | YES |
resources/workflow-schema.toon | Token-efficient format consumed by AI via MCP | NO — auto-generated |
resources/ai-editing-skill-template.md | Skill template loaded at AI editor launch | YES |
scripts/generate-toon-schema.ts | TOON generator | YES (rare) |
After editing .json, regenerate .toon:
npm run generate:toonThe full build (npm run build) does this automatically as the first step.
When the AI consistently picks the wrong node type, look here in priority order:
connections.overview.forbidden, exportValidationRules, postGenerationChecklist) — these can encode false constraints (e.g., "no cycles allowed" when the runtime allows them, since the runtime is an AI that uses judgment, not a deterministic executor). Removing false constraints is itself a valid improvement.npm run generate:toon.npm run check && npm run build.npm run debug launches a fresh Extension Development Host. Trigger the AI editor with a node-type-agnostic prompt (no hints like "use a sub-agent for X") and inspect the generated workflow.generate:toon, confirm the change took effect by grepping the relevant string in workflow-schema.toon. The MCP delivers TOON, not JSON.Per the project's conventional commit policy:
improvement: (patch bump)chore: (no release)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.