arazzo-specification — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited arazzo-specification (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Write, review, and modify Arazzo workflow specifications that describe deterministic, multi-step API workflows on top of OpenAPI.
operationIds needed.references/01-overview-and-structure.md for document skeleton and naming.references/02-core-constructs.md for source descriptions, steps, parameters, request bodies, and runtime expressions.operationId (preferred), operationPath, or workflowId.references/03-criteria-flow-outputs.md.components — read references/04-reuse-and-composition.md.references/04-reuse-and-composition.md.references/06-ai-agents-validation-practices.md.references/07-pitfalls-tooling-resources.md and scan for common pitfalls.operationId references exist in the source OpenAPI document(s).references/06-ai-agents-validation-practices.md for patterns on exposing Arazzo workflows as MCP tools and reducing LLM token consumption.arazzo: "1.0.1"
info:
title: Workflow Title
version: "1.0.0"
description: What this workflow achieves.
sourceDescriptions:
- name: myApi # Descriptive name, used as operationId prefix
url: ./openapi.yaml
type: openapi
workflows:
- workflowId: my-workflow
summary: One-line purpose.
inputs:
type: object
properties:
param_name:
type: string
steps:
- stepId: first-step
description: What this step does and why.
operationId: myApi.someOperation
parameters:
- name: paramName
in: query
value: $inputs.param_name
successCriteria:
- condition: $statusCode == 200
outputs:
result_id: $response.body#/id
- stepId: second-step
operationId: myApi.anotherOperation
parameters:
- name: id
in: path
value: $steps.first-step.outputs.result_id
successCriteria:
- condition: $statusCode == 200
outputs:
workflow_result: $steps.first-step.outputs.result_id
components:
parameters: {}
inputs: {}
successActions: {}
failureActions: {}| Expression | Resolves To |
|---|---|
$inputs.fieldName | Workflow input value |
$steps.stepId.outputs.name | Output from a previous step |
$statusCode | HTTP response status code |
$response.body | Full response body |
$response.body#/json/pointer | Specific field via JSON Pointer (RFC 6901) |
$response.header.name | Response header value |
$request.body#/json/pointer | Specific field in request body |
$workflows.workflowId.outputs.name | Output from another workflow |
$components.parameters.name | Reusable parameter from components |
$url / $method | Request URL / HTTP method |
Embedding in strings: Use curly braces — "Bearer {$steps.auth.outputs.token}". When the entire value is an expression, no braces needed: value: $inputs.pet_id.
JSON Pointer: #/0/id = first array element's id. #/data/customer/email = nested field. Escape / as ~1, ~ as ~0.
Use exactly one per step (mutually exclusive):
| Field | When to Use |
|---|---|
operationId | Preferred. Stable across path changes. Format: sourceName.operationId. |
operationPath | Third-party APIs without operationId. Format: sourceName.{jsonPointer}. |
workflowId | Invoke sub-workflow. Local: workflowId. External: $sourceDescriptions.name.workflowId. |
inputs schemas only).value override.$statusCode == 200 || $statusCode == 201.end, goto, retry (with retryAfter and retryLimit).arazzo.yaml or arazzo.json.arazzo version field set to "1.0.1".summary and description on info, workflows, and steps.workflowIds reflect business outcomes: apply-coupon, not workflow1.stepIds reflect actions: search-pets, not step1.sourceDescription names are descriptive: payments, not api2.[A-Za-z0-9_\-]+.operationId preferred over operationPath.operationId exists in the source OpenAPI document.operationId / operationPath / workflowId per step.successCriteria defined on every step.onFailure actions for rate limits (429), auth expiry (401).retryAfter and retryLimit values.failureActions as defaults; step-level overrides where needed.components/parameters.components/inputs.components/successActions and components/failureActions.references/01-overview-and-structure.md — What Arazzo is, ecosystem context, document structure, first document walkthrough.references/02-core-constructs.md — Source descriptions, workflows, steps, parameters, request bodies, runtime expressions.references/03-criteria-flow-outputs.md — Success criteria, control flow (success/failure actions), outputs and data threading.references/04-reuse-and-composition.md — Reusable components and workflow composition (local and cross-document).references/05-complete-example.md — End-to-end e-commerce checkout example demonstrating all features together.references/06-ai-agents-validation-practices.md — AI agent and MCP integration patterns, validation/linting tools, best practices checklist.references/07-pitfalls-tooling-resources.md — Common pitfalls, tooling ecosystem, and learning resources.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.