← Back to Skills Marketplace
9800
Downloads
5
Stars
71
Active Installs
1
Versions
Install in OpenClaw
/install clawflows
Description
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps.
Usage Guidance
Review the npm package and workflow YAML before installing or running anything. Use `clawflows check` and `--dry-run` first, avoid untrusted registry workflows, and be especially careful with automations that send email, write calendar events, update databases, publish content, or enable cron scheduling.
Capability Analysis
Type: OpenClaw Skill
Name: clawflows
Version: 1.0.0
The skill instructs the agent to install the 'clawflows' CLI globally via `npm i -g clawflows` (SKILL.md), introducing a supply chain risk from the npm package. The installed CLI is designed to download and execute external automation YAML files, which can then trigger arbitrary shell commands defined within other skills' `CAPABILITY.md` files. This nested execution model, combined with external downloads and the ability to provide instructions for persistence (cron jobs), creates a significant attack surface for arbitrary code execution and potential compromise, even if no direct malicious payload is present in this bundle.
Capability Assessment
Purpose & Capability
The stated purpose matches the artifact: search, install, and run multi-skill automations. The concern is breadth: downloaded automations can invoke capabilities such as database writes, calendar read/write, email send/receive, and other connected skills.
Instruction Scope
The skill documents check and dry-run commands, but it does not establish clear approval boundaries, allowlists, containment, rollback, or required review before side-effecting workflows run.
Install Mechanism
Installation uses a global npm package, `clawflows`, and the reviewed artifact does not include the CLI source. This is purpose-aligned for a CLI-based skill but leaves runtime behavior dependent on the npm package and registry content.
Credentials
The skill itself declares no direct credentials, but automations may exercise privileges from other installed skills and accounts, including email, calendar, database, social search, and similar integrations.
Persistence & Privilege
Scheduling is disclosed through an enable command that shows cron setup instructions, with a disable command documented. Users should still treat enabled automations as recurring delegated authority.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install clawflows - After installation, invoke the skill by name or use
/clawflows - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release - multi-skill automation framework
Metadata
Frequently Asked Questions
What is Clawflows?
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps. It is an AI Agent Skill for Claude Code / OpenClaw, with 9800 downloads so far.
How do I install Clawflows?
Run "/install clawflows" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Clawflows free?
Yes, Clawflows is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Clawflows support?
Clawflows is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Clawflows?
It is built and maintained by Cluka-399 (@cluka-399); the current version is v1.0.0.
More Skills