workflow-config — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-config (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are configuring the Structured Agentic Development Workflow.
Parse the user's preferences from: $ARGUMENTS
Then persist each preference to your agent's persistent memory so it applies across all future workflow phases and sessions.
/test-driven-development.Only one can be active at a time. Setting one disables the other.
When caveman is enabled, ALL workflow skills (brainstorm, write-plan, build-phase, 3p-review, triage, systematic-debugging, verification-before-completion) adapt their output to the requested brevity level. Technical accuracy is never sacrificed — only prose style changes.
Important: This workflow does NOT bundle or vendor the Caveman skills package. If the user wants caveman to also govern the agent's base system prompt (outside of workflow skills), they should install the caveman package separately (e.g., via npx @anthropics/skills). The workflow's caveman compatibility works independently — it adapts workflow skill output regardless of whether the caveman package is installed.
features.md, bugs.md, or under docs/plans/) for tracking backlog. GitHub integration is disabled.origin remote, so no further configuration is required for the common case.Optional GitHub keys (only set when you need to override the defaults):
owner/repo format (e.g., nikhilw/structured-agentic-workflow). Leave unset to auto-derive from git remote get-url origin. Useful when issues live in a different repo than origin.Save each preference as a memory entry in your agent's persistent memory system. Use whatever memory mechanism your platform provides — the key requirement is that the preference survives across conversation sessions.
Memory entries should be structured as:
workflow-config:<preference-name> (e.g., workflow-config:testing-methodology, workflow-config:caveman-level, workflow-config:use-github-issues, workflow-config:github-repo, workflow-config:github-project-id)bdd, full, true/false, owner/repo)The following are NOT configurable — they are core workflow guarantees:
new/ → plans/ → done/. Cannot be bypassed.After saving preferences, confirm what was set:
## Workflow Configuration Updated
- Testing methodology: [TDD / BDD]
- Output style: [normal / caveman lite / caveman full / caveman ultra]
- Use GitHub Issues: [true / false]
- GitHub repo: [owner/repo override / auto-derived from origin]
- GitHub Project ID: [project ID or not set]
These preferences are saved to memory and will apply to all future workflow phases.If the user asks to see current configuration, read the preferences from memory and display them in the same format.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.