Workflows
9 recipes, filter by use case, license, or difficulty.
Buzz + Hermes over ACP: prove channel scope bounds what an agent reads, because signing is provenance not authorization
Run Hermes as an ACP channel member inside Block's Buzz workspace without giving it your whole workspace to read, by proving that Buzz's signed event log is complete provenance yet not authorization, so only scoping the agent to one narrow channel bounds what it can read.
n8n as an MCP server: prove each exposed workflow is one narrow tool behind its own token
Expose n8n workflows to an agent through MCP Server Triggers without handing it your whole toolbox, by proving each agent-callable trigger is one narrow workflow behind its own bearer token with no wildcard-HTTP or delete-capable node, so a leaked token or a prompt injection is bounded.
Shepherd: prove an agent task is retained and least-privilege before it runs
Declare an agent task's per-repo read/write grants and hold its output to one side (retained, not applied), then validate that nothing auto-applies and every write grant is explicit, before you run it.
Vet the fine print a star count hides: real license and a gate on dual-use tools
Before you build on a starred repo, record its actual license (not an assumed permissive one) and whether it is dual-use, so a custom license or an impersonation risk never surprises you after you have shipped.
Agent-Reach: throwaway account, least privilege, scan before install
Before letting Agent-Reach install system dependencies and register a skill that logs into platforms with your cookies, encode the safe defaults as a preflight manifest: a throwaway account never your main, cookie-auth risk acknowledged per platform, and a mandatory scan before install.
Vet a SKILL.md before you install it
Treat an agent skill like the untrusted dependency it is: parse its SKILL.md, confirm the frontmatter is well-formed, and surface every executable script it bundles, since the research flagged script-bearing skills as the most dangerous, before you ever let your agent run it.
SkillSpector: fail your CI build on a risky agent skill
Scan every skill you did not write with SkillSpector and gate CI on the result, so a malicious or vulnerable SKILL.md fails the build instead of running with your agent's permissions at runtime.
Claude Code Auto Mode: A Classifier Instead of an Allowlist
Set Auto Mode as your default so a classifier reviews each action instead of pre-listing every command.
Claude Code: Lock Down an Unattended Run with Permission Rules
Define exactly what a scheduled or headless Claude Code run may do via settings.json permission rules.