← 返回 Skills 市场
13213
总下载
5
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install clawflows
功能描述
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps.
安全使用建议
Review the clawflows npm package and each automation YAML before installing or running it. Prefer dry-run first, avoid granting workflows access to email, calendars, databases, or scheduling unless you trust the publisher and understand the requested capabilities, and be cautious with the global npm install because it is not pinned to a reviewed version.
功能分析
Type: OpenClaw Skill
Name: clawflows
Version: 1.0.0
The skill instructs the agent to install the 'clawflows' CLI globally via `npm i -g clawflows` (SKILL.md), introducing a supply chain risk from the npm package. The installed CLI is designed to download and execute external automation YAML files, which can then trigger arbitrary shell commands defined within other skills' `CAPABILITY.md` files. This nested execution model, combined with external downloads and the ability to provide instructions for persistence (cron jobs), creates a significant attack surface for arbitrary code execution and potential compromise, even if no direct malicious payload is present in this bundle.
能力评估
Credentials
Automations resolve abstract capabilities to whatever compatible skills are present locally, which is coherent with the purpose but broad: the artifact does not document per-workflow allowlists, sandboxing, or least-privilege limits.
Install Mechanism
The skill metadata and instructions install the clawflows CLI from npm as an unpinned global package, so the installed code can change after this review and remains available system-wide for the user environment.
Instruction Scope
The documented flow installs and runs automations by registry name, with check and dry-run available but optional. The artifact does not require publisher verification, content inspection, pinned revisions, hashes, or explicit approval of requested capabilities before execution.
Persistence & Privilege
The artifact does not directly install persistence, but it documents an enable command that shows cron setup instructions for scheduled automation runs. Disable and logs commands are also documented.
Purpose & Capability
The stated purpose matches the artifact: search, install, and run multi-skill automations. The concern is that those automations can invoke high-impact capabilities including database writes, calendar read/write, email send/receive, social search, and scheduling.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install clawflows - 安装完成后，直接呼叫该 Skill 的名称或使用
/clawflows触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release - multi-skill automation framework
元数据
常见问题
Clawflows 是什么？
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 13213 次。
如何安装 Clawflows？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawflows」即可一键安装，无需额外配置。
Clawflows 是免费的吗？
是的，Clawflows 完全免费（开源免费），可自由下载、安装和使用。
Clawflows 支持哪些平台？
Clawflows 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Clawflows？
由 Cluka-399（@cluka-399）开发并维护，当前版本 v1.0.0。
推荐 Skills