Exploration of the agentic-workflows custom agent behavior across 7 representative automation scenarios drawn from 5 software worker personas. The agent was simulated using general-purpose agents loaded with gh-aw conventions (the agentic-workflows type is not directly invokable as a task agent).

Persona Overview

• Agent tested: agentic-workflows (simulated)
• Scenarios tested: 7 across 5 personas
• Average quality score: 4.74 / 5.0
• Top score: 25/25 — DB Migration Safety Review (Backend Engineer)
• Lowest score: 22/25 — PR Coverage Tracker (QA Tester)

Key Findings

1. Security posture is consistently excellent — all 7 workflows correctly applied read-only agent permissions with writes exclusively via safe-outputs. The pattern appears deeply embedded in the agent's behavior.
2. Fuzzy scheduling mastery — every scheduled workflow correctly used weekly on monday around 09:00 with auto-added workflow_dispatch, following gh-aw best practices exactly.
3. Bash allowlists preferred over wildcards — the agent consistently produced explicit bash: ["command:*"] allowlists rather than bash: true, which is the security-first pattern.
4. noop always included — every workflow included a noop safe-output path, preventing the most common workflow failure mode.
5. One structural gap found — PR-triggered workflows (FE1, QA1) did not include a concurrency block, which is a production-readiness gap for rapid-push scenarios.

Top Patterns

1. PR triggers: pull_request: types: [opened, synchronize, reopened] with paths: filters — used in 3/7 scenarios
2. Tools: GitHub MCP with minimal toolsets + explicit bash allowlists; cache-memory for state persistence
3. Security: 100% read-only permissions + safe-outputs; strict: true in 3/7 explicitly; network.allowed scoped to go, node, github, api.osv.dev as appropriate
4. Output hygiene: close-older-issues: true / hide-older-comments: true used in recurring reports to prevent accumulation
5. Progressive disclosure: <details>/<summary> blocks in all report templates for scannable issue/comment output

concurrency:
  group: "workflow-name-$\{\{ github.ref }}"
  cancel-in-progress: true

Recommendations

1. Add concurrency block template to .github/aw/create-agentic-workflow.md — Include a standard example for PR-triggered workflows showing group: "workflow-$\{\{ github.ref }}" / cancel-in-progress: true. This single addition would prevent a common production-readiness gap across all PR automation scenarios.

2. Document MCP tool filtering limitations in .github/aw/github-mcp-server.md — Explicitly note that list_pull_requests and similar list tools may not support server-side label/date filtering; instruct agents to always fetch and client-side filter. Prevents silent data gaps in PM and reporting workflows.

3. Add Python/bash data handoff pattern to .github/aw/github-agentic-workflows.md — Include a canonical pattern for shell→Python data passing (write to temp JSON file, json.load() in Python) to replace ad-hoc variable interpolation in multi-language analysis workflows.

References:

• Workflow run: §24225274462
• Cache report saved to: /tmp/gh-aw/cache-memory/agent-persona-explorer-2026-04-10.json

Generated by Agent Persona Explorer · ● 5.1M · ◷