← 返回 Skills 市场
12982
总下载
5
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install clawflows
功能描述
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps.
安全使用建议
Install only if you are comfortable trusting the `clawflows` npm CLI and the automations you choose from its registry. Before running a workflow, inspect the downloaded YAML, run `clawflows check`, use `--dry-run`, and be especially cautious with automations that send email, modify calendars or databases, access accounts, publish content, or enable scheduled execution.
功能分析
Type: OpenClaw Skill
Name: clawflows
Version: 1.0.0
The skill instructs the agent to install the 'clawflows' CLI globally via `npm i -g clawflows` (SKILL.md), introducing a supply chain risk from the npm package. The installed CLI is designed to download and execute external automation YAML files, which can then trigger arbitrary shell commands defined within other skills' `CAPABILITY.md` files. This nested execution model, combined with external downloads and the ability to provide instructions for persistence (cron jobs), creates a significant attack surface for arbitrary code execution and potential compromise, even if no direct malicious payload is present in this bundle.
能力评估
Purpose & Capability
The purpose is coherent: the skill is for searching, installing, and running multi-skill automations. The concern is that those automations can invoke broad capabilities including database writes, calendar read/write, email send/receive, social search, and other connected skills.
Instruction Scope
The artifact documents `check` and `--dry-run`, but it does not clearly define approval boundaries, trust requirements, review steps for downloaded YAML, or containment for side-effecting workflows before `clawflows run` executes them.
Install Mechanism
Installation uses a global npm package, `npm i -g clawflows`, and the reviewed artifact does not include the CLI source. This is aligned with a CLI-based skill, but shifts runtime trust to the npm package and registry content.
Credentials
The skill itself does not request credentials directly, but its workflows can exercise whatever privileges are available through installed skills, including email, calendar, database, social, and network-connected integrations.
Persistence & Privilege
Scheduling is disclosed through `clawflows enable`, which says it shows cron setup instructions, and `disable` is documented. Scheduled automations still represent recurring delegated authority and should be reviewed carefully.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install clawflows - 安装完成后，直接呼叫该 Skill 的名称或使用
/clawflows触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release - multi-skill automation framework
元数据
常见问题
Clawflows 是什么？
Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 12982 次。
如何安装 Clawflows？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawflows」即可一键安装，无需额外配置。
Clawflows 是免费的吗？
是的，Clawflows 完全免费（开源免费），可自由下载、安装和使用。
Clawflows 支持哪些平台？
Clawflows 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Clawflows？
由 Cluka-399（@cluka-399）开发并维护，当前版本 v1.0.0。
推荐 Skills