Auto Workflow

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: critical finding, no behavioural pass, undeclared transfer.

For each remaining URL, `WebFetch` with prompt: "Return page title, meta description, all <link rel='alternate'>, og:* meta tags, social handle links (x.com, github.com, t.me, discord), detected RSS/A

Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan

• Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
• Source folderaaronjmars/aeon/skills/auto-workflowThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Two-mode aeon.yml workflow builder - analyze inspects URLs and emits a tiered, signal-verified skill-enablement plan plus an aeon.yml diff; enable flips slugs to enabled:true and opens a PR.

---
name: auto-workflow
description: Two-mode aeon.yml workflow builder - analyze inspects URLs and emits a tiered, signal-verified skill-enablement plan plus an aeon.yml diff; enable flips slugs to enabled:true and opens a PR.
metadata:
  title: Auto-Workflow Builder
  category: core
  var: ""
  tags:
    - meta
    - dev
  mode: write
  commits: true
  permissions:
    - contents:write
    - pull-requests:write
---
<!-- autoresearch: variation B — sharper output (priority tiers + data-verification gates + delta-against-existing + exit taxonomy) + slug-enable execution branch (validate → commit → PR) -->
> **${var}** — selects the mode:
> - **Analyze (default):** a URL to analyze (GitHub repo, X account, blog, project site, API docs, etc.). Multiple URLs comma-separated. Prefix a URL with `force:` to re-analyze one already in the ledger. Produces a tiered recommendation article + an `aeon.yml` diff — it does **not** mutate `aeon.yml`.
> - **Enable:** `enable:slug1,slug2,...` — flip those skills' `enabled: false → true` in `aeon.yml`, validate each against `skills/`, then commit + open a PR. `enable:dry-run:slug1,slug2` validates and reports without editing, committing, or opening a PR.
>
> Example values: `https://example.com/blog` · `@vitalikbuterin, github.com/foundry-rs/foundry` · `force:https://mirror.xyz/somedao` · `enable:rss-digest,github-monitor` · `enable:dry-run:price-alert`

## Overview

One skill, two ends of the same loop: **analyze** decides *what to enable* for a new watch target; **enable** actually flips the switch. Dispatch `enable:` with the slugs the analyze run put in its MUST tier and you close the loop — recommendation to merged PR — without a second skill.

**Analyze mode** verifies every recommendation is backed by an *observed* signal on the URL, tiers output into **MUST** (2–3 max) / **SHOULD** / **NICE** with a one-line concrete "why", emits a *delta* against the current `aeon.yml` rather than a full config dump, stays silent when existing config already covers the URL, and anchors skill names in `skills.json` (authoritative), not a stale mapping table. It writes an article + updates a ledger; it never edits `aeon.yml`.

**Enable mode** does the mechanical part analyze deliberately leaves to the operator: a slug-scoped `enabled: false → true` substitution in `aeon.yml`, gated by directory presence / current-disabled-state / chain-conflict checks, committed on a fresh branch and shipped as a PR with per-skill rationale. Explicit opt-in only — the operator names the slugs; nothing flips on `main` until they click merge.

---

## Shared preamble (run for both modes)

1. Read `memory/MEMORY.md` for high-level context and skim the last ~3 days of `memory/logs/` — drop anything already reported so you don't re-emit the same signal.
2. Parse `${var}` to pick the branch:
   - `${var}` is empty → **Analyze** branch, empty-input path → exit `AUTO_WORKFLOW_EMPTY`, notify `auto-workflow: set var= to one or more URLs (comma-separated), or enable:slug1,slug2 to flip skills on`.
   - `${var}` starts with `enable:` (case-insensitive) → **Enable** branch. Strip the `enable:` prefix; the remainder is the slug list (which may itself begin with `dry-run:`). Go to **Mode B**.
   - Otherwise → **Analyze** branch. Go to **Mode A**.

---

## Mode A — Analyze: generate recommendations + aeon.yml diff (default)

### A0. Parse input and load context

If the (post-preamble) input is empty → exit `AUTO_WORKFLOW_EMPTY`, notify as above.

Parse `${var}`:
- Split on `,`, trim each entry
- Detect `force:` prefix on any entry → sets `force=true` for that URL (skip ledger dedup)
- Normalize each URL:
  - Add `https://` if scheme missing
  - `twitter.com/` → `x.com/`
  - `@handle` → `https://x.com/handle`
  - Strip trailing `/`, fragment, and tracking params (`utm_*`, `ref`, `src`, `s`, `t`)
  - Strip trailing `.git` on github URLs
- Reject `javascript:`, `data:`, local file URLs → exit `AUTO_WORKFLOW_ERROR` with the bad URL

Read context:
- `memory/MEMORY.md` — operator interests
- `aeon.yml` — CURRENT skill enablement, `var`, `schedule`, `model` per skill (this is the comparison baseline)
- `skills.json` — authoritative installed-skill list
- `memory/topics/auto-workflow-analyzed.md` (if exists) — for ledger dedup

**Ledger dedup:** If a URL is in the ledger with `analyzed_at` within the last 14 days and `force` is not set for it, skip it with `already_analyzed` reason. If ALL inputs are dedup-skipped → exit `AUTO_WORKFLOW_NO_CHANGE`, notify nothing, log a one-line skip entry.

---

### A1. Fetch and classify

For each remaining URL, `WebFetch` with prompt: "Return page title, meta description, all <link rel='alternate'>, og:* meta tags, social handle links (x.com, github.com, t.me, discord), detected RSS/Atom feed URLs, and any token contract addresses (0x... or Solana base58 near the words 'token'/'contract'/'mint'). Report the most recent date on the page. Report the tech stack (Jekyll/Hugo/Next.js/WordPress etc)."

If fetch fails or returns <300 chars of meaningful content, try fallbacks: `/robots.txt`, `/sitemap.xml`, `gh api` for github URLs. If all fail → mark this URL `FETCH_FAILED` with reason and continue to next URL.

Classify into ONE primary category: `github-repo` / `github-org` / `x-account` / `blog-or-news` / `crypto-project` / `api-or-docs` / `research` / `product` / `community` / `personal-site` / `other`.

Extract **concrete signals** (the "why" anchors for later recommendations):
- `feed_urls`: list of RSS/Atom URLs discovered
- `x_handles`: list of X handles linked from page
- `github_repos`: list of owner/repo from page links
- `token_contracts`: list of (chain, address, symbol) tuples
- `last_update`: most recent date found (ISO)
- `update_cadence`: estimate — `active` (<7d old), `steady` (<30d), `quiet` (<90d), `dormant` (≥90d)
- `tech`: stack hint if any

If classification confidence is low (sparse signals, no category clearly matches), mark `UNCLASSIFIED` for this UR

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/aaronjmars/aeon
git -C aeon checkout 0448e87653f9

Works in

1. 2026-10-14
   ✕BLOCK D 69 / 100

   first audit · source 0448e87653f9

Questions about Auto Workflow

• github.com/aaronjmars/aeon/tree/main/skills/auto-workflow — the audited source at commit 0448e87653f9 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology