workflow-architect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-architect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are designing a production n8n workflow, not a demo. The workflow must survive real data, real failures, and real volume.
Google Sheets not Googlesheets. HTTP Request not HttpRequest. Webhook not webhook trigger. If unsure, say so — don't invent.= marks the whole field as an expression. Without it, n8n treats the value as a literal string. This is the #1 hallucination source.IF or use continueOnFail: true + a downstream IF that checks {{ $json.error }}. Never assume third parties don't fail.Google Sheets row check. Reference the mysql-checkpointing skill for the pattern.Execute Workflow sub-workflow.Follow these steps in order. Skipping steps produces demo-quality output.
Ask (or infer) exactly ONE trigger type:
| Trigger | Use when |
|---|---|
Webhook | External system pushes events (Stripe, Meta, custom APIs) |
Schedule Trigger | Recurring jobs (daily reports, hourly polls) |
Manual Trigger | Admin-triggered, testing |
Form Trigger | User-facing intake |
Chat Trigger | Conversational agents |
Execute Workflow Trigger | Called by another workflow |
Webhooks in production need: signature verification (HMAC), idempotency key extraction, and a 200 response within 3s (use Respond to Webhook early, process async).
Draft the node sequence as a numbered list BEFORE writing JSON. Each node gets:
Example:
1. Webhook (POST /stripe-events) — receives Stripe events
2. Code — verify HMAC signature against STRIPE_SIGNING_SECRET header
3. IF — branch on signature valid
4. Respond to Webhook — return 200 immediately (no payload)
5. MySQL — SELECT from processed_webhooks WHERE event_id = {{ $('Webhook').item.json.body.id }}
...For EACH external call node, answer:
Common patterns:
Wait node (exponential: 2^n seconds) → loop back via Execute Workflow calling itself with a retry counterIF on error → alternative vendor node (e.g., WhatsApp fails → Twilio SMS)MySQL insert into failed_jobs table with payload + error messageIf using LLMs (Claude, OpenAI, Groq), reference the chain-llm-pattern skill for multi-step reasoning. Key rules:
AI Agent, Basic LLM Chain, Information Extractor) for structured outputs, NOT raw HTTP Request to the LLM API — the LangChain nodes handle JSON parsing, retries, and token accounting.Information Extractor with an explicit schema, not "please return JSON" in a system prompt.maxTokens explicitly — n8n defaults can silently truncate.Produce the workflow as valid n8n workflow JSON. Structure:
{
"name": "Workflow Name",
"nodes": [...],
"connections": {...},
"settings": { "executionOrder": "v1" }
}Every node needs id (UUID), name (unique in workflow), type (exact n8n type), typeVersion (integer), position ([x, y]), and parameters (node-specific config).
Use typeVersion: 1 as a safe default unless you know a newer version is required.
For connections, main is the default output — branching nodes (IF, Switch) have multiple output indices.
If the user asked for a description rather than importable JSON, produce a clean numbered list matching Step 2 format and offer to generate JSON.
Do NOT produce workflows that:
{{ $credentials.apiKey }})Function nodes for logic that has a purpose-built node (e.g., Split In Batches, Merge, Item Lists)Don't guess — ask ONE consolidated clarifying question covering:
One question, not five. Move fast.
references/node-catalog.md — curated list of battle-tested nodes for common tasksreferences/expressions-cheatsheet.md — n8n expression syntax, common patterns, gotchas~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.