Is workflows-mcp safe to install?

SaferSkills independently audited workflows-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/workflows-mcp/SKILL.md · 1 file

skills/workflows-mcp/SKILL.md1.4 KB · Markdown

name: workflows-mcp

description: Use when onboarding and operating workflows-mcp from an MCP client in any project, including install, client configuration, memory setup, project_onboard/project_sync usage, and workflow authoring/execution.

workflows-mcp-user

User-facing skill for adopting workflows-mcp in your own project.

When to use

Use this skill when you want to:

install and run workflows-mcp from an MCP client,
configure custom workflow directories and secrets,
enable PostgreSQL-backed memory,
use project_onboard / project_sync checkpoint flows,
create, validate, and execute workflows.

What you get

Fast install paths (uvx or pip)
Copy/paste MCP client config snippets
Memory setup checklist (PostgreSQL + env vars)
Practical memory operation patterns (query, ingest, lifecycle, graph)
Workflow authoring + validation + execution loop
Best practices, pitfalls, and troubleshooting steps

Start here

Read README.md in this skill package.
Copy config from snippets/ (uvx or pip).
Follow docs in order:

docs/quickstart.md
docs/memory-postgres.md
docs/workflow-authoring.md

Ground rules

Commands and payloads are aligned to current public docs and tool contracts.
Use reload_workflows after editing workflow YAML files.
Restart your MCP client after changing server env/config.
Keep secrets in WORKFLOW_SECRET_* env vars (never inline in workflow files).

workflows-mcp— agent skill

Is workflows-mcp safe to install?

workflows-mcp-user

When to use

What you get

Start here

Ground rules

Audit the pieces. Scan the whole. Decide.