marcora-workflow-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited marcora-workflow-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The companion skill to the Marcora MCP server, focused on workflows.
You can help the user build, modify, and run Marcora workflows. A workflow lets the user describe a multi-step process once and run it reliably afterwards — manually on demand, on a schedule, or both — without re-explaining the steps each time.
Mindset: A workflow is a reusable, named process. Some workflows are scheduled (a daily digest, a weekly competitor sweep). Many are not (a launch playbook, a customer-onboarding routine the user wants to run on demand). Both are first-class. Don't assume "workflow = recurring scheduled task" — the user's intent might be either, and the skill applies to both.
Listen for these patterns:
since_last_run input binding.If the intent is ambiguous, ask: "Do you want to run this once, or set it up as a reusable process you can run again later — manually, on a schedule, or both?"
name, steps, description, inputs, allowed_tools, tags, optional schedule_config. Always creates as status="draft".update_workflow to avoid clobbering unknown fields.status, search, pagination. Call with search: before creating to spot duplicate names.status: "active" to activate, status: "archived" to soft-delete..status on the returned row: "running" = success, "failed" = check .error_reason.run_id for single-run detail with step logs and tool call logs; omit run_id for a paginated list.The MCP tool definitions document each parameter — don't restate them. This skill covers the workflow patterns, the user-facing decisions, and the gotchas the schemas can't.
create_workflow after they agree.create_workflow. Two valid answers:create_content (a new content piece in Marcora), add_context (add to a Context Collection), create_project, update_context, create_external_share, GMAIL_SEND_EMAIL / Slack / Teams / Discord, GOOGLETASKS_INSERT_TASK / Asana / Linear, Google Docs / Sheets / Notion. The actual options depend on the user's connected toolkits.Don't call create_workflow until you have a clear answer (a or b). The backend rejects empty allowed_tools with allowed_tools_required regardless — even a summary-only workflow needs read tools spelled out (e.g. web_search, web_browse).
description must be specific enough that a fresh agent can act on it without follow-up questions. Include agent_hint for non-obvious execution guidance. Tool names that appear in step descriptions render as inline code chips in the UI; write them in their canonical SCREAMING_SNAKE_CASE form (e.g. GMAIL_SEND_EMAIL).update_workflow with status: "active" once they confirm.schedule_config: {"frequency": "daily"|"weekly"|"hourly", "interval_hours": N, "timezone": "UTC"}. The trigger is created with is_enabled=false; the user activates it from the UI. Cron expressions are not supported in v1. Skip `schedule_config` entirely for manual-only / on-demand workflows — those are perfectly valid and the user runs them via the UI's "Run now" button or via run_workflow.last_successful_run_at. Don't compute it yourself.Workflow steps are executed by a runner agent in a background session. The runner's FINAL agent message becomes the workflow run's result_summary, which the user reads on the workflow's run-detail page. When you write step descriptions or agent_hints, instruct the runner to:
url or link field in their response — include it in the summary as a markdown link so the user can jump straight to the artifact (e.g. [New blog post: How AI rewrites GTM](https://app.marcora.ai/library/abc123)). The same applies to anything created in connected integrations that returns a URL (Google Docs, Notion pages, Linear issues, etc.).The relay parses these prefixes from the runner's final message and sets the workflow_run status:
Workflow complete: <markdown> → status = succeeded, result_summary = markdownPartial completion: <markdown> → status = succeeded with partial flagSKIP: <reason> → status = skipped (e.g., the input resolver returned no entities to process)FAIL: <reason> → status = failedIf no prefix is found, the runner's final message becomes result_summary as-is.
update_workflow status: "archived" instead. If the user asks to "delete" a workflow, archive it and note that it can be restored via update_workflow status: "draft" or "active".list_workflows search: "<name>" first.create_workflow or update_workflow.For broader Marcora object-model and content-creation patterns (blueprints, projects, briefs, context items, generation), the marcora-mcp skill is the authority. This skill assumes you already have that context and focuses solely on the workflow surface.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.