create-workflow-python — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-workflow-python (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill describes how to create a Dapr Workflow application using Python.
You MUST follow these phases in strict order:
## Show final message section. Do NOT add any other text, summary, or commentary after it.If you don't have enough context what to build, ask the user the following clarifying questions one by one using an interview style:
The following must be installed by the user before this skill can run:
Additional runtime dependencies (handled during project setup):
dapr-ext-workflow version 1.18.0 (pulls in dapr 1.18.0)docker run -p 8080:8080 ghcr.io/diagridio/diagrid-dashboard:latestCreate the project root folder inside the current location where the terminal is open:
mkdir <ProjectRoot>
cd <ProjectRoot>The <ProjectName> should start with the <ProjectRoot> and end with -app: <ProjectRoot>-app.
<ProjectRoot>/
├── .gitignore
├── dapr.yaml
├── local.http
├── resources/
│ └── statestore.yaml
└── <ProjectName>/
├── pyproject.toml
├── main.py
├── models.py
├── runtime.py
├── workflow.py
└── activities.pyPython style .gitignore file in the project root. See REFERENCE.md for full example.
Multi-app run file in the project root. Configures the Dapr sidecar and points to the resources folder. See REFERENCE.md for full example and key points.
Dapr Workflow requires a state store component (with actorStateStore set to "true"). See REFERENCE.md for full example and key points.
Python configuration file used by packaging tools. See REFERENCE.md for full example.
Main entry for the Python workflow application. See REFERENCE.md for full example.
Pydantic types for workflow and activity input/output, placed in a models.py file. Models must be serializable since Dapr persists workflow state. As of dapr-ext-workflow 1.18, Pydantic models can be passed directly to schedule_new_workflow, call_activity, and call_child_workflow — no manual model_dump() is needed. See REFERENCE.md for full example and key points.
The runtime.py file creates the shared WorkflowRuntime instance (wfr). Both workflow.py and activities.py import wfr from this file. This avoids a circular import between workflow.py and activities.py. See REFERENCE.md for full example.
A workflow is defined using the @wfr.workflow(name="<NAME>") attribute. The workflow code is placed in a workflow.py file. It imports wfr from runtime.py. See REFERENCE.md for full example, key points, determinism rules, and workflow patterns (chaining, fan-out/fan-in, sub-workflows).
A workflow activity is defined using the @wfr.activity(name="<NAME>") attribute. The activity code is placed in an activities.py file. It imports wfr from runtime.py. See REFERENCE.md for full example and key points.
HTTP request file for testing the workflow endpoints. Contains a start request (POST) to schedule a new workflow instance and a status request (GET) to query the workflow state. Uses the <app-port> from dapr.yaml. See REFERENCE.md for full example.
IMPORTANT: After Project Setup you MUST run these exact verification instructions:
uv venv in the <ProjectName> folder to create a virtual environment.uv sync in the <ProjectName> folder to install dependencies.IMPORTANT: After Verify you MUST run these instructions:
Create a README.md file inside the <ProjectRoot> folder.
The README contains the following sections:
local.http file.See REFERENCE.md for additional instructions on running locally and running with Catalyst.
IMPORTANT: This is the LAST step. After Create README.md, your final output MUST be ONLY the message below — no preamble, no summary, no additional commentary, only replace the <ProjectRoot> with the actual value:
The <ProjectRoot> workflow application is created. Open the README.md file in the <ProjectRoot> folder for a summary and instructions for running locally.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.