← Back to Skills Marketplace
Workflow Engine
by
Pedro Gonzalez
· GitHub ↗
· v1.0.0
1246
Downloads
0
Stars
13
Active Installs
1
Versions
Install in OpenClaw
/install workflow-engine
Description
Structural parity skeleton for queue-driven orchestration in a workflow context.
Usage Guidance
This is an instruction-only skeleton that reads/writes local 'ops' and queue files and otherwise behaves as a deterministic orchestrator. Things to consider before installing or running anything: 1) The package contains no install scripts or hook definitions, yet the README tells you to run './install-hooks.sh' and 'openclaw hooks enable' — do not run unknown install scripts; obtain and inspect them first. 2) Enabling hooks modifies agent-wide behavior; only enable them if you trust the source and understand what each hook does. 3) Review any local ops/queue files for secrets before letting the skill read them, and consider running in an isolated/test agent to observe effects. 4) If you need more assurance, ask the publisher for the missing install artifacts, source repository, or a signed release before enabling hooks in production.
Capability Analysis
Type: OpenClaw Skill
Name: workflow-engine
Version: 1.0.0
The skill is classified as suspicious primarily due to the `allowed-tools: Bash` permission and the 'Installation' section in `SKILL.md`. This section instructs the AI agent to execute an external script `./install-hooks.sh` (which is not provided for analysis) and to enable OpenClaw hooks. The execution of an unknown script via `Bash` introduces a significant supply chain vulnerability, as its contents could be malicious. While the 'Safety Constraints' section attempts to mitigate shell injection risks, the underlying capability for `Bash` execution and the instruction to run an unverified script raise a strong suspicion of potential misuse or vulnerability.
Capability Assessment
Purpose & Capability
Name and description match the instructions: this is a skeleton workflow/queue orchestrator that reads/writes local queue and ops files. However, the SKILL.md includes installation steps (./install-hooks.sh, openclaw hooks enable) that imply additional artifacts or system changes that are not present in the package. That mismatch is noteworthy but could be legitimate if install artifacts are distributed separately.
Instruction Scope
Runtime instructions direct the agent to read and persist local files (ops/*, ops/queue/*) which is consistent with a queue orchestrator. But the SKILL.md also instructs running an install script and invoking openclaw hooks enable commands that will modify agent hooks/configuration; those steps are outside the normal read/operate-on-queue scope and could change agent behaviour. The skill permits use of Bash as an allowed tool while also claiming 'Never: execute arbitrary shell from user-provided strings' — that is a useful safety constraint but still leaves room for shell actions. The skill itself does not include the install script or hook definitions to audit.
Install Mechanism
There is no formal install spec (lowest install risk). However, the SKILL.md provides manual install instructions that reference './install-hooks.sh' and 'openclaw hooks enable'—neither file nor script is included. The absence of provided install artifacts means a user would need to obtain or run external scripts whose contents are unknown.
Credentials
The skill declares no required environment variables, binaries, or config paths. The requested scope of access (reading ops/ and queue files) is proportional to the stated purpose.
Persistence & Privilege
The skill does not force persistent inclusion (always:false), which is good. But its installation guidance explicitly tells operators to enable hooks via 'openclaw hooks enable', which would modify agent-level hook configuration (i.e., system/other-skills behavior). Instructions that change hook configuration are a persistence/privilege concern because they alter agent behavior beyond the skill's own runtime, and the skill package doesn't include the artifacts to inspect before making those changes.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install workflow-engine - After installation, invoke the skill by name or use
/workflow-engine - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: derivation pipeline, queue state machine, runtime loader, real OpenClaw hooks (session-orient, write-validate, session-capture), hook config generation, auto-install script
Metadata
Frequently Asked Questions
What is Workflow Engine?
Structural parity skeleton for queue-driven orchestration in a workflow context. It is an AI Agent Skill for Claude Code / OpenClaw, with 1246 downloads so far.
How do I install Workflow Engine?
Run "/install workflow-engine" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Workflow Engine free?
Yes, Workflow Engine is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Workflow Engine support?
Workflow Engine is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Workflow Engine?
It is built and maintained by Pedro Gonzalez (@plgonzalezrx8); the current version is v1.0.0.
More Skills