Process Flow Navigator

业务流程图导航助手 - 帮助你在复杂的多分支流程中导航、规划路径、查询技能编码。支持 A→K 主流程及所有子流程分支。

This skill appears coherent and local-only, but exercise the usual caution: (1) the CLI script uses python3 though the metadata lists no required binaries — ensure python3 is available or adapt the script before use; (2) the source/homepage are unknown, so review data/flow-rules.json to confirm the flow matches your expectations and contains no sensitive information you wouldn't want stored in a skill; (3) run the script in a sandbox or non-production environment first if you have any doubts; (4) because the skill is user-invocable and can be invoked by the agent autonomously (normal default), only enable it if you trust the owner or have inspected the files — there is no evidence of network calls or credential access in the package.

Type: OpenClaw Skill Name: process-flow-navigator Version: 1.0.0 The skill bundle contains a command injection vulnerability in `scripts/navigate.sh`. The `get_node_code` function interpolates the `$node` shell variable directly into a `python3 -c` command string without sanitization, which could allow an attacker to execute arbitrary Python code. While the logic in `SKILL.md`, `README.md`, and `data/flow-rules.json` appears aligned with the stated purpose of business process navigation, the presence of this high-risk vulnerability requires a suspicious classification.