workflow-migrate

Migrate N8N/Zapier/Make workflows to production-grade Python or Node.js scripts. Given a workflow description or paste, rewrites automation logic with retry,...

This skill appears to do what it says (generate production-style scripts) but has some inconsistencies you should address before installing: 1) The SKILL.md templates expect API keys and a .env file, but the skill metadata doesn't declare any required credentials — confirm with the author which secrets you'll need and how they should be provided. 2) The allowed-tools include filesystem and shell access; avoid granting the agent access to workspace files that contain unrelated secrets (home dir, CI/CD credentials, SSH keys, etc.). 3) Inspect any generated scripts for hardcoded endpoints, excessive logging of sensitive payloads, and proper error handling before running them in production. 4) Run generated code in a sandbox or isolated environment, and rotate any secrets used for initial testing. If you need higher assurance, ask the publisher for an explicit list of required env vars and a minimal reproduction that shows exactly which files will be read/written.

Type: OpenClaw Skill Name: workflow-migrate Version: 1.0.0 The skill is classified as suspicious due to significant prompt injection and code generation vulnerabilities, amplified by broad permissions. The agent is instructed to generate executable Python/Node.js scripts based on user input, which presents a code injection risk. Critically, the agent is also instructed to generate a new `SKILL.md` file (Step 6), which is an agent instruction file, creating a direct prompt injection surface where malicious user input could lead to the agent executing arbitrary commands or revealing sensitive information. The `allowed-tools` include `Bash`, `Read`, `Write`, and `Edit`, providing extensive capabilities that could be abused if these vulnerabilities are exploited. There is no clear evidence of intentional malicious behavior by the skill owner, but the potential for exploitation is high.