create-workflow-dotnet — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-workflow-dotnet (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill describes how to create a Dapr Workflow application using .NET.
You MUST follow these phases in strict order:
## Show final message section: the closing sentence followed by the Dev Dashboard recommendation. Do NOT add any other text, summary, or commentary.The following must be installed by the user before this skill can run:
Additional runtime dependencies (handled during project setup):
Dapr.Workflow version 1.18.10## Check optional tools); it never installs it and never stops without it.Check once whether the optional Diagrid Dapr Dev Dashboard is installed by following the Check section of ../dapr-shared/dev-dashboard.md (diagrid-dev-dashboard --version). Remember the result (DevDashboardInstalled) for the final message. This check never stops the skill: do not ask the user about it, do not install anything, and continue with the next step whether or not the dashboard is installed.
If you don't have enough context what to build, ask the user the following clarifying questions one by one using an interview style:
Before creating any file, write out the resolved names and restate them to the user in two or three lines, so a wrong reading is caught before it is scaffolded. Resolve them exactly as ../dapr-shared/workflow-placeholders.md defines them: <WorkflowName> from the purpose, <WorkflowInput> and <WorkflowOutput> from its stem, and one <ActivityName> per step with its <ActivityInput> and <ActivityOutput>.
Create the project root folder inside the current location where the terminal is open, then create a new ASP.NET Core web application inside it:
mkdir <ProjectRoot>
cd <ProjectRoot>
dotnet new web -n <ProjectName>
dotnet add <ProjectName> package Dapr.Workflow --version 1.18.10The <ProjectName> should start with the <ProjectRoot> and end with App: <ProjectRoot>App.
<ProjectRoot>/
├── .gitignore
├── dapr.yaml
├── local.http
├── resources/
│ └── statestore.yaml
└── <ProjectName>/
├── <ProjectName>.csproj
├── Program.cs
├── Properties/
│ └── launchSettings.json
├── Models/
│ └── <ModelName>.cs
├── Workflows/
│ └── <WorkflowName>.cs
└── Activities/
└── <ActivityName>.csVisual Studio style .gitignore file in the project root. Ignores build output (bin, obj), debug/release folders, and other common .NET artifacts. See REFERENCE.md for full example.
Multi-app run file in the project root. Configures the Dapr sidecar and points to the resources folder. See REFERENCE.md for full example and key points.
Dapr Workflow requires a state store component (with actorStateStore set to "true"). See REFERENCE.md for full example and key points.
Configures the application port, which must match appPort in dapr.yaml. See REFERENCE.md for full example.
Standard ASP.NET Core web project targeting net10.0 with the Dapr.Workflow package. See REFERENCE.md for full example.
Record types for workflow and activity input/output, placed in a Models folder. Must be serializable since Dapr persists workflow state. See REFERENCE.md for full example and key points.
Uses AddDaprWorkflow() to register the Dapr Workflow runtime (workflows and activities are auto-registered). Uses DaprWorkflowClient to schedule workflow instances and query status via HTTP endpoints. See REFERENCE.md for full example and key points.
Inherits from Workflow<TInput, TOutput>, overrides RunAsync, and orchestrates activities via context.CallActivityAsync. Must be internal sealed partial (partial is required for [LoggerMessage] methods). Place in a Workflows folder and the <ProjectNamespace>.Workflows namespace. See REFERENCE.md for full example, key points, determinism rules, and workflow patterns (chaining, fan-out/fan-in, sub-workflows).
Inherits from WorkflowActivity<TInput, TOutput>, overrides RunAsync, and contains the actual business logic. Must be internal sealed partial (partial is required for [LoggerMessage] methods). Place in an Activities folder and the <ProjectNamespace>.Activities namespace. See REFERENCE.md for full example and key points.
HTTP request file for testing the workflow endpoints. Contains a start request (POST) to schedule a new workflow instance and a status request (GET) to query the workflow state. Uses the <app-port> from launchSettings.json. See REFERENCE.md for full example.
IMPORTANT: After Project Setup you MUST run these checks:
dotnet build on the .csproj file. It must succeed; fix any errors and rebuild until it does. Never report the project as created while the build fails.dapr run -f . in the project root.IMPORTANT: After Verify you MUST run these instructions:
Create a README.md file inside the <ProjectRoot> folder.
The README contains the following sections:
local.http file.../dapr-shared/dev-dashboard.md: why it is useful, the install command for each OS (macOS / Linux and Windows) and the run command (diagrid-dev-dashboard, http://localhost:9090).review-workflow-determinism, review-workflow-activity and review-workflow-management skills to audit the generated code.See REFERENCE.md for additional instructions on running locally and running with Catalyst.
IMPORTANT: This is the LAST step. After Create README.md, your final output MUST be ONLY the message below followed by the Dev Dashboard recommendation — no preamble, no summary, no additional commentary, only replace the <ProjectRoot> with the actual value:
The <ProjectRoot> workflow application is created. Open the README.md file in the <ProjectRoot> folder for a summary and instructions for running locally.
Then add, as a separate paragraph, the block from the Final recommendation section of ../dapr-shared/dev-dashboard.md that matches DevDashboardInstalled (installed → start it; not installed → install it). Use it as written, including the link and the commands. Nothing may follow it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.