Quack Workflow Engine

Execute multi-step workflows via Orchestrate. Use when running complex workflows, parallel tasks, multi-model orchestration, or automating multi-step processes.

Security Scan

The skill mostly matches its stated purpose (sending a workflow file to an orchestration service) but has notable inconsistencies and data-exfiltration risks—most importantly it will upload arbitrary local files to an external endpoint without any declared authentication or safeguards.

Purpose & Capability

The skill's name, description, and included templates align with a workflow/orchestration purpose: it reads a workflow YAML and POSTs it to https://orchestrate.us.com/api/v1/workflows/run. However, SKILL.md instructs you to 'register at orchestrate.us.com for API access' but neither the instructions nor the script accept or document any API key/config; that mismatch is unexplained.

Instruction Scope

The runtime script reads any local file the user passes and uploads its full contents to a remote host. That behavior is consistent with sending a workflow, but it also means the skill can exfiltrate arbitrary local files if misused or pointed at a sensitive path. There are no prompts, no authentication headers, and no explicit safeguards or restrictions on what gets read and transmitted.

Install Mechanism

This is an instruction-only skill with a small Node script included and no install spec; nothing is downloaded or written to disk by an installer. That low-footprint model reduces installer risk.

Credentials

The SKILL.md tells users to register for API access, but the skill declares no required env vars or primary credential and the script does not take or read any API key, token, or config path. This omission is inconsistent: a remote orchestration API typically requires credentials. The lack of declared/authenticated credential handling is suspicious and may lead to unauthenticated uploads or hidden out-of-band credential usage.

Persistence & Privilege

The skill does not request persistent/always-on inclusion, does not modify other skills or system-wide configs, and does not declare elevated privileges.

What to consider before installing

Before installing or running this skill, consider that it will read any local YAML file you point it at and upload the full contents to https://orchestrate.us.com without presenting or documenting an API key or other authentication. That can leak sensitive data if you accidentally pass a secrets file or point it at the wrong path. The source/publisher is unknown and there is no homepage. If you still want to use it: (1) inspect and understand the script (it is short) and run it only on non-sensitive test files; (2) ask the publisher how API authentication is intended to work and insist the script accept a provided API key (env var or config) and include Authorization headers; (3) prefer a version that prompts for confirmation before uploading and supports a safe dry-run; (4) verify the orchestrate.us.com domain and hosting (it may be legitimate or a lookalike); and (5) run the tool in a network-restricted sandbox until you trust it. Because the issues could be sloppy engineering or intentional, proceed cautiously.

Workflow Engine

Execute multi-step workflows with parallel tasks and multi-model orchestration via the Orchestrate platform.

Setup

Register at orchestrate.us.com for API access.

Scripts

Run a Workflow

node skills/workflow-engine/scripts/run-workflow.mjs --file workflow.yaml

Example Workflow Templates

See skills/workflow-engine/templates/ for ready-to-use workflow definitions.

Workflow YAML Format

name: example-workflow
steps:
  - id: research
    action: web_search
    params:
      query: "latest AI news"
  - id: summarize
    action: llm
    params:
      model: claude
      prompt: "Summarize: {{research.output}}"
    depends_on: [research]
  - id: post
    action: social_post
    params:
      text: "{{summarize.output}}"
    depends_on: [summarize]

API Reference

• Base URL: https://orchestrate.us.com
• Multi-step workflow execution
• Parallel task support
• Multi-model orchestration