Skill Composer

编排多个OpenClaw技能成自动化工作流，一次命令完成复杂任务。

What to check before installing: 1) Understand the delegation risk: Composer runs whatever 'claw skill exec <skill>' you list in workflows. Verify that every skill you will orchestrate is trusted and does not have permissions to read/exfiltrate secrets or sensitive files. 2) Ensure the required runtime is present: The code calls the 'claw' CLI but the top-level metadata did not declare 'claw' as a required binary. Confirm you have a legitimate 'claw' binary (the OpenClaw CLI) and that it is the expected official tool. 3) Use preview/validate first: The composer provides preview and validate modes—use them to inspect what will run before executing workflows. Start with non-privileged workflows in a sandboxed environment. 4) Check path/documentation mismatches: SKILL.md and install.sh reference scripts under 'scripts/', but the provided code is at source/composer.py. Confirm where to invoke the script and adjust paths if needed. 5) Review assumptions in workflows: The composer assumes the last arg is the output path and uses simple string interpolation; ensure your workflows conform to these expectations or the recorded outputs may be wrong. 6) Condition expressions: Conditions are evaluated using eval with builtins removed, which limits abuse but is not perfectly safe—avoid trusting untrusted workflow files. 7) Installation: install.sh uses apt-get or pip3 to install PyYAML (no external downloads). Prefer installing in an isolated environment (venv/container) to limit system impact. If you need to proceed: run composer.py preview <workflow> and validate first, audit all skills you plan to call, and run in an isolated environment until you are confident.

Type: OpenClaw Skill Name: skill-composer Version: 1.0.0 The skill-composer bundle is designed to orchestrate multiple OpenClaw skills into automated workflows using YAML definitions. It is classified as suspicious due to the use of the `eval()` function in `source/composer.py` to process conditional logic ('if' statements) within workflow files; while it attempts to restrict built-ins, this remains a significant code execution vulnerability if an agent or user processes an untrusted YAML file. The core functionality relies on `subprocess.run` to execute other skills, which is consistent with its stated purpose but represents a high-privilege capability.