← Back to Skills Marketplace
13213
Downloads
5
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install clawflows
Description
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps.
Usage Guidance
Review the clawflows npm package and each automation YAML before installing or running it. Prefer dry-run first, avoid granting workflows access to email, calendars, databases, or scheduling unless you trust the publisher and understand the requested capabilities, and be cautious with the global npm install because it is not pinned to a reviewed version.
Capability Analysis
Type: OpenClaw Skill
Name: clawflows
Version: 1.0.0
The skill instructs the agent to install the 'clawflows' CLI globally via `npm i -g clawflows` (SKILL.md), introducing a supply chain risk from the npm package. The installed CLI is designed to download and execute external automation YAML files, which can then trigger arbitrary shell commands defined within other skills' `CAPABILITY.md` files. This nested execution model, combined with external downloads and the ability to provide instructions for persistence (cron jobs), creates a significant attack surface for arbitrary code execution and potential compromise, even if no direct malicious payload is present in this bundle.
Capability Assessment
Credentials
Automations resolve abstract capabilities to whatever compatible skills are present locally, which is coherent with the purpose but broad: the artifact does not document per-workflow allowlists, sandboxing, or least-privilege limits.
Install Mechanism
The skill metadata and instructions install the clawflows CLI from npm as an unpinned global package, so the installed code can change after this review and remains available system-wide for the user environment.
Instruction Scope
The documented flow installs and runs automations by registry name, with check and dry-run available but optional. The artifact does not require publisher verification, content inspection, pinned revisions, hashes, or explicit approval of requested capabilities before execution.
Persistence & Privilege
The artifact does not directly install persistence, but it documents an enable command that shows cron setup instructions for scheduled automation runs. Disable and logs commands are also documented.
Purpose & Capability
The stated purpose matches the artifact: search, install, and run multi-skill automations. The concern is that those automations can invoke high-impact capabilities including database writes, calendar read/write, email send/receive, social search, and scheduling.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install clawflows - After installation, invoke the skill by name or use
/clawflows - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release - multi-skill automation framework
Metadata
Frequently Asked Questions
What is Clawflows?
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps. It is an AI Agent Skill for Claude Code / OpenClaw, with 13213 downloads so far.
How do I install Clawflows?
Run "/install clawflows" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Clawflows free?
Yes, Clawflows is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Clawflows support?
Clawflows is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Clawflows?
It is built and maintained by Cluka-399 (@cluka-399); the current version is v1.0.0.
More Skills