| name | scenario-reader |
| description | Parses Make.com scenario blueprints into structured, analyzable form. Detects issues (missing error handlers, hardcoded credentials, inefficient triggers) and flags data sensitivity for compliance scanning. |
Skill: scenario-reader
Parses Make.com scenario blueprints into structured, analyzable form.
Input: raw Make.com blueprint JSON. Output: structured representation.
Input
Make.com scenario blueprint from MCP response. Contains:
flow array — ordered list of modulesmetadata — scenario settings, scheduling, statusconnections — module-to-module data mappings
Output Structure
See output-schema.md for the full JSON output structure.
Issue Detection Rules
Critical (must fix)
- Module with
can_fail: true and has_error_handler: false
- Trigger module type is
watch on a service that supports webhook (inefficient polling)
- Any module with hardcoded API key, password, or token in config values
- Circular reference in module routing (infinite loop risk)
- Module reading from connection not present in workspace
Warning (should fix)
- No filters before modules that charge per API call (e.g., OpenAI, external APIs)
- Scenario has no notification path on any error handler
- Iterator without array aggregator (data leaks between runs)
- Using HTTP module where native app module exists
- More than 15 modules in single scenario (consider splitting)
- Schedule trigger running more frequently than data actually changes
Info (nice to have)
- Last run > 30 days ago (possibly orphaned)
- Module count > 10 (document the flow)
- No scenario description set in Make.com
Data Sensitivity Detection
Mark touches_personal_data: true if any module:
- Connects to a CRM (HubSpot, Salesforce, Pipedrive)
- Processes form submissions with fields: name, email, phone, address
- Reads from or writes to HR systems
- Handles EU or Quebec user data (check for EU region connections)
Mark touches_payment_data: true if any module:
- Connects to Stripe, PayPal, Shopify
- Contains fields: card, payment, invoice, billing
Mark touches_health_data: true if any module:
- Connects to health/medical services
- Contains fields: diagnosis, patient, health, medical
Hardcoded Credential Detection
Scan all module config values for patterns:
- Strings matching API key patterns (length > 20, mixed alphanumeric, no spaces)
- Email/password fields with literal values
- Authorization header values that are not variable references
- Any config value containing "secret", "key", "token", "password"
Flag as critical issue if found.
