MCP Workflow

Workflow automation using MCP (Model Context Protocol) patterns inspired by Jason Zhou

Before installing or running this skill: - Expect to need Node.js and the jq CLI (the scripts call node and jq, but the registry metadata does not declare them). - Review the two included scripts (scripts/mcp-server.js and scripts/workflow-engine.sh) yourself — they read and write files and will read any path given via file:// URIs. Do not run them against sensitive directories or as root. - The server can return arbitrary local files (file://{path}) to workflows; if you run the skill inside an agent with access to your home or project files, workflows or templates could leak data. Consider running inside a sandbox/container with limited filesystem scope. - The SKILL.md mentions config:// and an OpenClaw config at ~/.openclaw/mcp-workflow.json, but the server code does not implement config:// reads nor automatically load that path — verify configuration behavior matches your expectations before relying on it. - If you need integrations (email, Notion, Git providers) verify whether those are actually implemented or whether templates merely reference them. Don’t provide credentials unless you confirm the code will use them only for the intended integrations. - If you’re unsure, run the code in an isolated environment, or ask the skill author for clarification about required binaries, which resource types are implemented, and where the skill will read/write data.

Type: OpenClaw Skill Name: mcp-workflow Version: 1.0.0 The skill is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in `scripts/mcp-server.js`. The `ReadResourceRequestSchema` handler for `file://` URIs directly uses the path provided in the URI without any path sanitization, allowing an attacker or compromised agent to read arbitrary files on the filesystem (e.g., `file:///etc/passwd`). While the skill's workflow execution is currently mocked, this LFI vulnerability presents a significant risk for data exfiltration.