agentic-workflowCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: onboard
description: Onboard the current project to agentic-workflow. Use when the user asks to set up, onboard or enable agentic-workflow (or "wf") in a project. Detects repos, components, commands and secrets, confirms them with the user, and proves the setup with wf doctor.
---

# Onboard a project

`wf` is the agentic-workflow CLI. If `wf` is not on PATH, run `node <this plugin's root>/bin/wf install` once (the plugin root is the folder holding this skill's `skills/` directory), or call `node <plugin root>/bin/wf` directly.

1. **Detect.** Run `wf init` at the project root (the repo, or the folder holding several repos). It drafts `.workflow/project.yaml` (disabled), `.workflow/secrets.yaml` (names only) and `.workflow/AGENTS.invariants.md`. In a multi-repo folder the adapter is written into the first repo and the folder's `.workflow` links to it; change `adapterRepo` if another repo should hold it.
2. **Confirm the system with the user.** Show a table of components (id, kind, repo/package, what it provides, what it depends on) and a dependency diagram. Ask them to confirm, rename, add missing components (including services in repos not checked out and third parties), and mark contracts that must never break.
3. **Ask only what you can't detect.** First the tracker, as two questions:
   - **Where do your tasks live?** Linear (`kind: linear`, its team), GitHub Issues (`kind: github`, `repo: owner/name`), markdown tickets in the repo (`kind: files`, one `tickets/<id>.md` each with YAML frontmatter `id, title, status, labels`; `wf init` drafts this when it finds them), or nowhere (`kind: none`, requests passed as files). Then the status names for started / delivered / done (on GitHub these are labels).
   - **How should wf reach it?** Prefer a route where the engine acts and reads back itself: `via: files` (files), `via: cli` (GitHub through the owner's existing `gh` login; wf never sees or prints the token), `via: api` (Linear or GitHub with a key the owner enters in step 5 with `wf secrets guide <KEY>`, catalogued in `.workflow/secrets.yaml` with `required: true`: `LINEAR_API_KEY` or `GITHUB_TOKEN`). `via: connector` is a first-class choice (you call the tracker's MCP tools; no key for wf). In Claude Code and Codex its handoff is host-recorded: `wf tracker record --from-transcript` takes the tracker's answer from the session transcript the host writes and checks it like an API readback; elsewhere it is agent-reported (unverified). `api`, `cli` and `files` are engine-read. Run `wf doctor` and tell the user the level it prints. Say this trade-off in those words and let the user choose. Write the choice with `wf tracker mode <via> --write` and tell the user what `wf doctor` prints as verifiable for that combination. On GitHub, screenshots go to a `wf-attachments` prerelease as assets. If the repository is public (`gh repo view <owner/name> --json isPrivate`; treat unknown as public), tell the user plainly that delivered screenshots will be publicly downloadable and ask which they want: keep it (write `publicAssets: acknowledged` under `tracker:` and commit it on the base branch; without it `wf deliver` refuses to upload screenshots there), switch to the files tracker, or keep the issues in a private repository.

   Then lanes (quick, standard, batch), the real invariants, and the product stage (pre-launch or live) — write the stage and invariants into `.workflow/AGENTS.invariants.md`.
4. **Gate steps.** Walk through each detected step: command, inputs, tier (light/heavy), lease, workers. Fix anything wrong in the draft. Add steps the detection missed.
5. **Secrets.** `wf init` catalogues only keys a detected step's command names; the rest are listed in a comment in `.workflow/secrets.yaml`. Add a key only when a gate step needs it, with `usedBy: [step ids]` (or `required: true`). Show the catalogued keys as a table (key, purpose, used by, kind, state from `wf secrets status`). Fill in `obtain` (console URL and steps) for each provided key. Run `wf secrets init` for generated and test keys. Only if `wf secrets status` reports a needed key missing, ask the user to run `wf secrets guide` **in their own terminal** — never in this session, never with `!`, never pasting values into chat. Poll `wf secrets status` until it says `nothing to enter`.
6. **Skills, connectors, tools.** List what the roles need. Vendor skills into `.workflow/skills/<name>/` only when the license allows (show it), add them under `requires.skills`, run `wf sync`. For connectors (the tracker), check with one read-only call and tell the user exactly where to connect it if missing.
7. **Prove.** After committing and pushing the adapter, run `wf doctor`. Config problems: fix the draft and rerun. Tests already failing on a clean base: fix them as the first quick fix; if the fix is large, stop and show the user the failing suites and logs.
8. **Enable.** Commit `.workflow/` on the base branch of the adapter repo and push it (the gate trusts only the adapter on the base it starts from), then `wf enable`. Tell the user what was set up and what is still pending.

CAUTIONgrade C · trust 70/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (10 observation(s))

Network

declared (5 observation(s))

Shell

declared (5 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

const secret = 'tok_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';

const token = 'ghp_echoedTokenValue12345';

const TOKEN = 'ghp_fakeApiTokenForTests123';

process.stdout.write('github.com\n  ✓ Logged in to github.com account tester (keyring)\n  - Token: gho_fakeTokenThatMustNeverBePrinted\n');

import { readRegular, writeNoFollow } from '../../engine/evidence.mjs';

import { canonical, isInside, touchesEvidence } from '../../engine/paths.mjs';

import { YAML } from '../../engine/util.mjs';

import { cliEnv } from '../../engine/scrub.mjs';

var identity = require('../../nodes/identity.js');

const p = singleRepoProject('exfil-gh-env', { tracker: { kind: 'github', repo: 'acme/app', via: 'cli', statuses, publicAssets: 'acknowledged' } });

const dbDir = tmp('exfil-echo');

const p = singleRepoProject('exfil-echo-proj', { tracker: { kind: 'github', repo: 'acme/app', via: 'api', apiUrl: url, statuses } }, keys('GITHUB_TOKEN'));

const p = singleRepoProject(`exfil-linear-${apiUrl.length}`, { tracker: { kind: 'linear', via: 'api', apiUrl, statuses } }, keys('LINEAR_API_KEY'));

const ok2 = singleRepoProject('exfil-linear-other', { tracker: { kind: 'linear', via: 'api', apiUrl: 'https://linear.example.test/graphql', statuses } }, keys('LINEAR_API_KEY'));

return { url: `http://127.0.0.1:${fs.readFileSync(`${file}.port`, 'utf8')}/graphql`, read: () => JSON.parse(fs.readFileSync(file, 'utf8')), stop: () => child.kill() };

return reply(200, { data: { fileUpload: { uploadFile: { uploadUrl: `http://127.0.0.1:${port}/upload/${encodeURIComponent(variables.filename)}`, assetUrl: `https://uploads.linear.app/fake/${encodeURICo

const url = `http://127.0.0.1:${fs.readFileSync(`${db}.port`, 'utf8')}`;

return { url: `http://127.0.0.1:${fs.readFileSync(`${file}.port`, 'utf8')}`, stop: () => child.kill() };

const str = atob(src.replace(/[\n\r]/g, ''));

for (const id of ['../x', '..', 'a/b', '/abs', '.hidden', '-flag', 'a\u0000b', 'x'.repeat(200), 'OK-1', 'ОK-1', 'a\\b', 'trail.']) {

{ name: 'an invisible character', value: () => path.join(f.root, '.wf-evidence', 'x.json'), re: /is inside \.wf-evidence/ },

'cat .wf-ev$(echo)idence/a', 'cat *evidence/a', 'cat .wf-evidence/a', 'cat .wf-evidence/a', 'cat .wf-evidence/a',

{ file_path: '/p/.wf-evidence/a' }, { file_path: '~/p/.wf-evidence/a' }, { file_path: '/p/.wf-evidence/a', edits: [{ old_string: 'a', new_string: 'b' }] },

for (const id of ['../outside', '../../x', 'a/b', '/abs/path', '.hidden', '-dash', 'a.b', 'a_b', 'x'.repeat(65), 'L‐1', 'L-1', 'ok id', '']) {

for (const id of ['../x', '..', 'a/b', '/abs', '.hidden', '-flag', 'a\u0000b', 'x'.repeat(200), 'OK-1', 'ОK-1', 'a\\b', 'trail.']) {

Gates applied: no_behavioural_pass.