Agent Economy ReportAgent Economy ReportSAFE version 0.1.0 · audited 2026-09-09
This package is a text-only advisory document about building no-code automation workflows (Zapier, Make, n8n) for solo business owners. It contains no scripts, no commands, no code that runs, and no network calls; the only URL is a link to the publisher's page on the registry site itself. The content is ordinary business guidance: how to spot repetitive tasks, pick a tool, sketch triggers and actions, test them, monitor failures, and estimate time savings. Nothing in the files asks the agent to read credentials, spend money, install software, or contact any external service. The accompanying skill card is consistent with the document's content and even flags data-exposure risks of connecting business tools. Reading this skill grants the agent no new capabilities beyond producing advice.
| Declared purpose | Help a solopreneur identify, design, build, test, and maintain no-code automation workflows across tools like Zapier, Make, and n8n, including ROI estimation. |
| Observed behavior | Purely static Markdown guidance: audit checklists, a tool comparison table, workflow design templates, testing and monitoring checklists, example workflow outlines, and arithmetic formulas. No executable code, no file writes, no environment variable reads, no shell or network operations appear anywhere in the package. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | exceeds purpose | No network requests are made. The single domain reference (skill-card.md lines 7 and 26, clawhub.ai) is a human-readable link to the publisher/skill page, not a fetch target. |
| severity | finding |
|---|---|
| info | Declared purpose matches the document contents The stated purpose is advisory guidance on automation workflows, and the remaining 265 lines are exactly that: checklists, tables, and templates. No mismatch between declaration and behavior. SKILL.md:3 description: Design and implement automation workflows to save time and scale operations as a solopreneur. |
| low | Advice involves connecting third-party accounts and permissions The guidance instructs the reader to authenticate business tools (CRM, email, Stripe, Slack) into an automation platform. The skill itself performs no authentication and handles no credentials, but a user following it will grant OAuth access to external vendors; the skill card acknowledges this risk and recommends minimum permissions. SKILL.md:130 2. **Connect your account** (authenticate via OAuth) |
| info | Mentions payment tooling as an example only Payment systems appear solely as illustrative workflow examples in text. There is no payment code, no wallet address, no payout destination, and no instruction that would move money. SKILL.md:224 TRIGGER: Payment received (Stripe webhook) |
| info | Only external domain is the registry itself clawhub.ai appears as a documentation hyperlink to the publisher and skill page. It is not fetched, and no data is sent to it by the package. skill-card.md:7 [jk-0001](https://clawhub.ai/user/jk-0001) <br> |
| info | Self-declared no-code-execution claim is consistent with the files The package contains no shell commands, no interpreter invocations, no downloads, and no persistence hooks, so the claim of no code execution is accurate for this package as shipped. skill-card.md:33 **Other Properties Related to Output:** [No code execution; |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 267 | 7e2a1b38c6f3558f… |
_meta.json | 6 | 27f5a6115e8c83c9… |
skill-card.md | 39 | c4955f7942219955… |
For agents
JSON: https://agenteconomy.report/k/automation-workflows.audit.json · badge: https://agenteconomy.report/k/automation-workflows.audited.svg ·
skill rating: /k/automation-workflows · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).