IBM Bob 2.0 Hackathon · Code review
Pre-deployment review for n8n workflows
Automations handle customer data, API keys and money, yet they rarely get a code review. FlowGuard runs 14 deterministic checks, then four IBM Bob subagents review security, reliability, cost and documentation in parallel. It returns a risk score, a corrected workflow, test payloads and a report.
View a sample report Source on GitHubHow it works
A developer exports a workflow as JSON and asks Bob to review it in the FlowGuard Reviewer mode.
14 deterministic checks for secrets, auth, injection, retries, branches, models and naming.
Four Bob subagents (Security, Reliability, Cost, Docs) confirm findings and add judgment calls.
One finding per node and category, with a 0–100 risk score before and after fixes.
A corrected workflow file, test payloads and a README. Unsafe fixes are left for a human.
An HTML report, a Markdown summary and a flow diagram coloured by severity.
Detection results
Six self-made sample workflows: five contain 26 planted issues and one is a clean control. The answer key was hidden from Bob and scored separately.
| Category | Rules only | Rules + Bob subagents |
|---|---|---|
| security | 5/6 | 6/6 |
| reliability | 7/9 | 9/9 |
| cost | 4/6 | 6/6 |
| docs | 5/5 | 5/5 |
| Total | 21/26 (81%) | 26/26 (100%) |
- Rules alone found 21 of 26. The rest need judgment: PII sent to an LLM, missing dedupe, AI output published without approval.
- 1 extra finding was not in the answer key: a real missing-dedupe issue we had not planted.
- The first full run found 25 of 26. After one merge-step fix, a re-run of that workflow reached 26 of 26.
- Review time was measured in Bob. The manual baseline of 30–60 minutes per workflow is an estimate.
Sample reports
Each report lists findings, the fixes applied, the fixes left for a human, and a diagram of the corrected workflow.
| Workflow | Findings | Manual fixes | Risk before → after | |
|---|---|---|---|---|
| Lead Capture → HubSpot CRM lead_capture_crm.json | 5 | 0 | 76 → 0 | Open report → |
| AI Email Triage ai_email_triage.json | 6 | 2 | 69 → 23 | Open report → |
| Invoices → Slack Approvals invoice_to_slack.json | 4 | 2 | 48 → 15 | Open report → |
| My workflow 3 webhook_to_sheets.json | 5 | 1 | 54 → 6 | Open report → |
| AI Blog Content Generator ai_content_generator.json | 7 | 3 | 100 → 55 | Open report → |
| Shopify Orders → Xero Invoices control order_sync_clean.json | 0 | 0 | 0 → 0 | Open report → |
Built with IBM Bob
Bob built FlowGuard and runs it. Task-session screenshots for every step are in the repository.
- /init generated AGENTS.md and mode rules from the project spec.
- Plan mode designed the engine: signatures, detection logic for all 14 rules, and tests.
- Agent mode wrote the parser, rules, renderer and 36 tests, then ran them until they passed.
- Custom mode and skill: the FlowGuard Reviewer mode, the n8n-workflow-review skill and its checklists.
- Parallel subagents reviewed all six workflows and produced the reports on this page.
Details: IBM Bob usage statement · task-session screenshots · .bob configuration