← 返回 Skills 市场

Orderflow

Name: Orderflow
Author: ncreighton

作者 ncreighton · GitHub ↗ · v1.0.0 · MIT-0

macoslinuxwin32 ⚠ suspicious

118

总下载

当前安装

版本数

在 OpenClaw 中安装

/install orderflow

功能描述

Automate order routing, fulfillment, and inventory management across channels. Use when the user needs real-time order processing, multi-warehouse routing, o...

安全使用建议

Before installing, get answers to these questions from the skill author or maintainer: (1) Provide a complete list of all credentials the skill will ever ask for (Google API creds, Twilio, SendGrid, ShipStation, 3PLs, etc.) and whether any are optional. (2) Confirm the minimum scope for WAREHOUSE_API_TOKEN and SHOPIFY credentials (read-only vs. read/write; restrict to test/staging when possible). (3) Explain where order/customer data is sent (exact domains/webhooks/Google Sheets accounts) and retention/PII handling policies. (4) Ask for examples of the exact commands or API calls the agent will perform (so you can audit for data exfiltration). (5) Test in a staging environment with limited-scope tokens before granting production credentials. Finally, treat the Slack webhook as a potential exfiltration channel — only provide a webhook you control and that is scoped to an appropriate channel.

功能分析

Type: OpenClaw Skill Name: orderflow Version: 1.0.0 The skill bundle requests a wide array of highly sensitive environment variables (Shopify, Slack, Warehouse, SendGrid, etc.) and instructs the agent to install and execute an unverified global NPM package (`orderflow-cli`) in SKILL.md. It also promotes insecure practices by suggesting that credentials be passed as command-line arguments during the authentication step. While the stated goal of e-commerce automation is plausible, the requirement for external binary execution and the broad access to high-value secrets without a verified provenance for the CLI tool present a significant security risk.

能力评估

ℹ Purpose & Capability

Requested binaries (curl, node) and required env vars (SHOPIFY_API_KEY, SHOPIFY_API_PASSWORD, WAREHOUSE_API_TOKEN, SLACK_WEBHOOK_URL) are consistent with an order-routing/automation skill. However, the SKILL.md advertises many other integrations (Google Sheets, Twilio SMS, SendGrid, ShipStation, multiple 3PLs and carriers) whose credentials are not declared in requires.env. That mismatch suggests either omissions in the manifest or that the skill will ask for or expect additional secrets at runtime — an incoherence worth clarifying.

⚠ Instruction Scope

SKILL.md is an instruction-only runtime spec that directs the agent to sync inventory, route orders, generate shipping labels, send Slack messages, create Google Sheets POs, and send SMS/email. Those actions involve reading and transmitting sensitive order/customer/inventory data to multiple external endpoints. The instructions as provided are broad and grant the agent wide discretion (scheduling periodic syncs, exception handling, auto-fulfill), but they don't enumerate how credentials for the non-declared integrations will be supplied, nor do they constrain what data fields may be shared externally. That openness increases the risk of unintended data exposure or overbroad access.

✓ Install Mechanism

No install spec and no code files—this is instruction-only. That's lower risk from an installation/executable perspective because nothing is dropped to disk by an installer. The runtime will rely on available system binaries (curl, node).

⚠ Credentials

The four declared env vars are sensitive but reasonable for core Shopify->warehouse->Slack operation. Concerns: (1) WAREHOUSE_API_TOKEN is opaque and could grant broad access to internal warehouse systems — it should be scoped and limited. (2) Many additional integrations mentioned in the docs (Google Sheets, Twilio, SendGrid, ShipStation, etc.) are not reflected in requires.env, so it's unclear how their credentials are handled. Requiring fewer, narrowly-scoped credentials is preferable; as-is, credential handling is underspecified.

✓ Persistence & Privilege

always is false and there is no install-time modification of other skills or system-wide settings documented. The skill can be invoked autonomously (default), which is normal for skills; this combined with broad/incomplete credential declarations increases risk, but autonomous invocation itself is not a reason to block.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install orderflow
安装完成后，直接呼叫该 Skill 的名称或使用 /orderflow 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

OrderFlow 1.0.0 initial release. - Introduces intelligent e-commerce order management workflows for multi-channel fulfillment. - Enables real-time order routing, inventory sync, and exception handling across multiple warehouses and platforms. - Integrates with Shopify, WooCommerce, Slack, Google Sheets, ShipStation, and more. - Provides customizable rule-based workflows, real-time alerts, and inventory orchestration. - Supports automated reporting, analytics, and multi-condition fulfillment logic.

元数据

Slug orderflow

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Orderflow 是什么？

Automate order routing, fulfillment, and inventory management across channels. Use when the user needs real-time order processing, multi-warehouse routing, o... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 118 次。

如何安装 Orderflow？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install orderflow」即可一键安装，无需额外配置。

Orderflow 是免费的吗？

是的，Orderflow 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Orderflow 支持哪些平台？

Orderflow 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（macos, linux, win32）。

谁开发了 Orderflow？

由 ncreighton（@ncreighton）开发并维护，当前版本 v1.0.0。