Workflowy

Workflowy outliner CLI for reading, searching, and editing nodes. Use when the user wants to interact with their Workflowy outline — searching, adding items,...

Security Scan

The skill's requirements and runtime instructions align with its described purpose (a Workflowy CLI wrapper); nothing appears to request unrelated credentials or perform unexpected actions, though the brew formula is a third‑party tap so verify it before installing.

Purpose & Capability

The name/description (Workflowy CLI) match the declared requirements: a 'workflowy' binary, a Workflowy API key (WORKFLOWY_API_KEY), and a config file at ~/.workflowy/api.key. These are appropriate for a CLI that reads/edits a Workflowy outline.

Instruction Scope

SKILL.md only instructs use of the workflowy CLI and how to provide the API key (file or env var). It does not instruct reading unrelated system files, exfiltrating data to unexpected endpoints, or modifying other skill/system configurations. It warns about destructive bulk operations.

Install Mechanism

Install uses a Homebrew formula (mholzen/workflowy/workflowy-cli) which is an expected mechanism for a CLI. Because this is a third‑party tap/formula rather than an official, widely-known package, users should inspect the formula/source before installing to ensure it does not run unexpected install-time scripts.

Credentials

The only credential required is the Workflowy API key (WORKFLOWY_API_KEY) and/or the config file ~/.workflowy/api.key, which is proportionate to the skill's purpose. No unrelated secrets or broad environment access are requested.

Persistence & Privilege

The skill is not marked always:true and is user-invocable; it does not request system-wide persistent privileges or modify other skills. Autonomous invocation is allowed by default but is not combined with other concerning privileges here.

Assessment

This skill appears to be what it says: a thin integration for the Workflowy CLI. Before installing, verify the Homebrew tap/formula source (mholzen/workflowy/workflowy-cli) on GitHub to ensure it doesn't contain unexpected install scripts. Provide only your Workflowy API key (store it at ~/.workflowy/api.key with restricted permissions or set WORKFLOWY_API_KEY), and be cautious when running destructive commands (delete, bulk replace). If you need higher assurance, inspect the brew formula and the CLI source code on the linked GitHub repo prior to installation.

Use the unofficial workflowy CLI mholzen/workflowy to interact with the Workflowy API for managing a Workflowy outline. Requires API key setup.

Setup (once)

Get your API key at https://workflowy.com/api-key/, save it to ~/.workflowy/api.key, and ensure only your user can access it:

mkdir -p ~/.workflowy
echo "your-api-key-here" > ~/.workflowy/api.key
chmod 600 ~/.workflowy/api.key

Alternatively, set the WORKFLOWY_API_KEY environment variable:

export WORKFLOWY_API_KEY="your-api-key-here"

Common commands

Note: See the full command reference for more details.

Reading

# Get root nodes (depth 2 by default)
workflowy get

# Get specific node by UUID or short ID
workflowy get <item-id>
workflowy get https://workflowy.com/#/59fc7acbc68c

# Show a node's children as a flat list
workflowy list <item-id>

# Search (full text, case-insensitive)
workflowy search -i "meeting notes"

# Search with extended regex
workflowy search -E "<time.*>"

# Search within a subtree
workflowy search "bug" --item-id <parent-id>

Writing

# Add a new node to the Inbox
workflowy create "Buy groceries" --parent-id=inbox

# Add a node to a specific parent
workflowy create "Task" --parent-id=<uuid>

# Update a node
workflowy update <item-id> --name "New name"

# Complete/uncomplete
workflowy complete <item-id>
workflowy uncomplete <item-id>

# Move a node
workflowy move <item-id> <new-parent-id>

# Delete a node (includes its children!)
workflowy delete <item-id>

Bulk operations

# Search and replace (dry run first!)
workflowy replace --dry-run "foo" "bar"
workflowy replace --interactive "foo" "bar"

# Regex find/replace using capture groups
workflowy replace "TASK-([0-9]+)" 'ISSUE-$1'

# Transform: split by newlines into children
workflowy transform <item-id> split -s "\n"

# Transform: trim whitespace
workflowy transform <item-id> trim

Statistics

# Where is most content?
workflowy report count --threshold 0.01

# Nodes with most children
workflowy report children --top-n 20

# Stale content (oldest modified)
workflowy report modified --top-n 50

# Most mirrored nodes (requires backup)
workflowy report mirrors --top-n 20

Data Access Methods

Method	Speed	Freshness	Use For
--method=get	Medium	Real-time	Specific items
--method=export	Fast (cached)	~1 min	Full tree access
--method=backup	Fastest	Stale	Bulk ops, offline

For offline mode, enable Workflowy's Dropbox backup:

workflowy get --method=backup

Short IDs

Workflowy supports short IDs, obtained from the "Copy Internal Link" menu:

• Web URL: https://workflowy.com/#/59fc7acbc68c
• Can be used directly, e.g. workflowy get https://workflowy.com/#/59fc7acbc68c

Special named targets

• inbox — user's inbox
• home — root of outline

workflowy create "Quick note" --parent-id=inbox
workflowy id inbox  # resolve to UUID

Notes

• Deleting a node also deletes all its children
• Results are sorted by priority (display order)
• Use --method=export for large tree operations (cached, faster)
• Mirror analysis requires using the backup method
• Make sure to confirm before performing bulk replace operations