[Improvement] Add agent tool calling and task execution workflow

[affanraza84]

Pull Request: Add Agent Tool Calling and Task Execution Workflow

Problem and Scope

AI agents increasingly execute real-world tasks through tools such as APIs, databases, internal services, and external integrations. These workflows introduce business and engineering risks that are different from simple LLM content generation, including unauthorized tool access, invalid arguments, unsafe side effects, duplicate execution, concurrency conflicts, partial failures, and recovery requirements.

The repository currently provides workflow packs for areas such as LLM content generation, RAG, and scheduled execution, but does not provide a dedicated workflow pack covering the lifecycle of an agent that dynamically selects and executes tools to complete a task.

This contribution adds a focused, reusable workflow pack for Agent Tool Calling and Task Execution, with a clear boundary around planning, authorization, tool execution, result validation, failure handling, and recovery.

What Changed

Added a new workflow pack:

prebuilt-workflow-paths/agent-tool-calling-and-task-execution/

The pack contains all required workflow files:

• README.md
• PRODUCT_AND_BUSINESS_GUIDE.md
• ENGINEERING_GUIDE.md
• CORE_20_SCENARIOS.md
• TESTING_GUIDE.md
• PATHS_AND_EDGE_CASES.md
• PERMISSION_AND_ABUSE_GUIDE.md
• RETRY_AND_RECOVERY_GUIDE.md
• WRITE_PRODUCT_SPEC_SKILL.md
• REVIEW_BUSINESS_RISK_SKILL.md
• UNDERSTAND_CODE_SKILL.md
• IMPLEMENT_WORKFLOW_SKILL.md
• TEST_WORKFLOW_SKILL.md

The workflow includes exactly 20 core scenarios covering successful execution and important failure, security, concurrency, retry, and recovery paths.

Updated:

prebuilt-workflow-paths/README.md

to include the new workflow in the workflow collection index.

Workflow Coverage

The workflow covers:

• Task intake and planning
• Dynamic tool selection
• Tool authorization
• Argument validation
• Tool execution and side effects
• Tool result validation
• Prompt-injection and untrusted-output risks
• Timeouts and dependency failures
• Retry and idempotency considerations
• Duplicate and concurrent execution
• Partial completion and recovery
• Escalation and final task completion

The workflow explicitly separates this lifecycle from adjacent workflows such as generic LLM generation, RAG retrieval, and scheduled job execution.

Verification

The contribution was validated locally using the repository's quality checks:

• python3 -m black --config .github/quality/pyproject.toml --check .github/quality/tests
• python3 -m flake8 --config .github/quality/.flake8 .github/quality/tests
• python3 -m pytest -c .github/quality/pyproject.toml .github/quality/tests
• Repository quality tests passed: 632 tests
• Markdown/link validation passed
• Exactly 20 core scenarios verified
• All required workflow-pack files are present
• No credentials, proprietary source, customer data, generated reports, or unsanitized logs were included

Remaining Limitations

This contribution is a reusable workflow specification and guidance pack. It does not modify UnvibeCode's core code-analysis or CLI behavior.

The workflow should still be adapted to the specific authorization model, tool contracts, data sensitivity, provider behavior, and operational requirements of the repository where it is applied.

Thank you for reviewing this contribution. I’d be happy to address any feedback or requested changes.