Quack Workflow Engine

Execute multi-step workflows via Orchestrate. Use when running complex workflows, parallel tasks, multi-model orchestration, or automating multi-step processes.

Before installing or running this skill, consider that it will read any local YAML file you point it at and upload the full contents to https://orchestrate.us.com without presenting or documenting an API key or other authentication. That can leak sensitive data if you accidentally pass a secrets file or point it at the wrong path. The source/publisher is unknown and there is no homepage. If you still want to use it: (1) inspect and understand the script (it is short) and run it only on non-sensitive test files; (2) ask the publisher how API authentication is intended to work and insist the script accept a provided API key (env var or config) and include Authorization headers; (3) prefer a version that prompts for confirmation before uploading and supports a safe dry-run; (4) verify the orchestrate.us.com domain and hosting (it may be legitimate or a lookalike); and (5) run the tool in a network-restricted sandbox until you trust it. Because the issues could be sloppy engineering or intentional, proceed cautiously.

Type: OpenClaw Skill Name: quack-workflow Version: 1.0.0 The skill is classified as suspicious primarily due to a Local File Inclusion (LFI) vulnerability in `scripts/run-workflow.mjs`. The script uses `readFile(resolve(args.file))` without sufficient sanitization or restriction on the `--file` argument, potentially allowing an attacker to read arbitrary files from the system if the OpenClaw agent permits user-controlled input for this argument. Additionally, the skill transmits the entire content of the specified workflow file to an external service at `https://orchestrate.us.com`, which could lead to data exposure if sensitive information is inadvertently included in the workflow definition.