Install
$ agentstack add skill-aborroy-aiup-alfresco-workflow-bpmn-validator ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Workflow BPMN Validator
Validate the given Alfresco Activiti BPMN process definition (and companion workflow model, if present) against these rules.
BPMN Namespace Validation
- Root element must be `` with BPMN 2.0 namespace:
xmlns="http://www.omg.org/spec/BPMN/20100524/MODEL"
- REQUIRED:
xmlns:activiti="http://activiti.org/bpmn"— must be present; Alfresco Activiti extensions use this namespace - ERROR if present: Any
org.flowable.*class reference inclassattributes of `,, or`. ACS 26.1 uses Activiti 5.22.x; the Flowable API is not on the classpath.
Process Structure Validation
- `` element must have:
idattribute (camelCase identifier)nameattribute (human-readable)isExecutable="true"- WARNING if any `
is missingactiviti:formKey` in a non-trivial process (more than one user task) - Every `
must have eitheractiviti:assigneeoractiviti:candidateGroups`: - WARNING if a user task has neither — it will never be claimable
- WARNING if a user task that represents an approval step is missing
activiti:formKey - Every `
with multiple outgoing sequence flows must have` on all but one outgoing flow: - ERROR if an outgoing flow from an exclusive gateway has no condition and is not marked as
default - Every `
must have eitheractiviti:classoractiviti:expressionoractiviti:delegateExpression`: - WARNING for service tasks with none of these attributes (becomes a no-op)
Variable Naming Validation
- Scan all `
blocks insideelements and inside` elements - ERROR if any call to
execution.setVariable(...)ortask.getVariableLocal(...)uses a variable name containing a colon (e.g.acme:outcome). The correct form uses underscore (acme_outcome). Alfresco maps content model properties{prefix}wf:{propName}→ process variable{prefix}wf_{propName}(colon → underscore). - ERROR if any `
references a variable with a colon in the name (e.g.${acme:count == 2}). Use${acme_count == 2}`.
Task Listener Validation
- Any `
orusing aclass` attribute: - ERROR if the class is from
org.flowable.* - Allowed built-in classes:
org.alfresco.repo.workflow.activiti.tasklistener.ScriptTaskListener,org.alfresco.repo.workflow.activiti.listener.ScriptExecutionListener - INFO if the class is custom (not from
org.alfresco.*) — confirm it implementsorg.activiti.engine.delegate.TaskListener
Timer Event Validation
- Every `
containing a` must have: cancelActivityattribute explicitly set to"true"or"false"— WARNING if missing- Timer duration in ISO 8601 format inside `
:PT{N}S,PT{N}M,PT{N}H,P{N}D`, or combinations — ERROR if the format does not match ISO 8601
Workflow Model Alignment
If a companion *-workflow-model.xml exists in the same module's model/ directory:
- Every
activiti:formKeyvalue in the BPMN must correspond to a `` declared in the workflow model: - ERROR if a formKey references a type not present in the workflow model
- The workflow model must import the
bpmnamespace:
``
- ERROR if this import is missing
- Every workflow task type must extend
bpm:startTask,bpm:activitiOutcomeTask, orbpm:workflowTask: - WARNING if a type in the workflow model has no recognized
bpm:parent - ERROR if any property in the workflow model uses `
— the integrity checker fires beforeaddAspect()writes properties, causing a spuriousIntegrityException`
Bootstrap Registration Check
If a bootstrap-context.xml exists in the module's context/ directory:
- WARNING if it contains a `
withparent="dictionaryModelBootstrap"that lists a.bpmnfile in itsmodelsproperty — BPMN files must be registered viaparent="workflowDeployer", notdictionaryModelBootstrap` - WARNING if the
workflowDeployerbean hastrue— this causes duplicate process definitions on every restart
Output
Report all violations with:
- File path and element ID (BPMN) or type name (workflow model)
- Rule violated
- Suggested fix
If no violations are found, confirm: "BPMN and workflow model are valid for ACS 26.1 / Activiti 5.x."
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: aborroy
- Source: aborroy/aiup-alfresco
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.