Openclaw Workflow Publish

OC-Flow：为你的 OpenClaw 注入"确定性"灵魂。OC-Flow 完全嵌入在 OpenClaw 体系内，赋予 Agent 完整的流程控制能力：条件分支、循环遍历、精准等待、状态管理。通过 YAML 剧本实现固定流程、多步循环、严苛逻辑的任务。适用场景：财务办公、开发运维、个人助理。

This skill is a full-featured workflow engine that will run arbitrary shell commands and inline Python from YAML, perform HTTP requests, send messages to external targets, and interact with your OpenClaw Gateway/sessions files. Before installing: - Confirm you have (and want the skill to use) the OpenClaw CLI/gateway and that your ~/.openclaw/openclaw.json is accessible; the code expects to read that file but the skill metadata does not declare this requirement. - Inspect scripts/engine/sandbox.py and engine/nodes.py to verify how 'code' nodes are sandboxed — inline Python may be able to access files/network unless properly restricted. - Be aware workflows can include script nodes that run arbitrary shell commands and HTTP nodes that can exfiltrate data; only run workflows from trusted sources and consider running the skill in an isolated environment or container. - If you rely on other OpenClaw sessions or skills, note the bridge manipulates sessions and factory child sessions; review cleanup behavior to ensure it won't affect unrelated sessions. - Ideally the publisher should update metadata to declare dependence on the 'openclaw' CLI and the ~/.openclaw config paths, and clarify dashboard scanning behavior. If you need higher assurance, request the maintainer to document sandbox guarantees and to limit undocumented access to OpenClaw configs.

Type: OpenClaw Skill Name: openclaw-workflow Version: 1.0.3 The OpenClaw Workflow engine provides extensive automation capabilities but contains significant security vulnerabilities that could be exploited. The 'sandbox' implementation in `scripts/engine/sandbox.py` is highly insecure, as it explicitly includes the `open` builtin and the `pathlib` module in its whitelist, allowing arbitrary file system read/write access. Furthermore, the `script` node in `scripts/engine/nodes.py` executes shell commands using `subprocess.run(shell=True)` on strings resolved from workflow templates, which facilitates Remote Code Execution (RCE). While these features are aligned with the tool's purpose as an orchestration engine, the lack of robust execution boundaries and input sanitization makes the bundle a high-risk component if untrusted workflows are processed.