Rule Creation

Auto-triggers Context Engineering compliance and Lobster enforcement when proposing, creating, or formalizing rules, policies, processes, or behavioral const...

This skill does what it says: it decides whether a proposed rule needs enforcement and immediately appends entries to governance files and may write Lobster workflow files in ~/clawd. Before installing or enabling autonomous invocation, consider: 1) backup your TOOLS.md, SOUL.md, and any agents/* files; 2) disable autonomous invocation or require confirmation if you don't want automatic edits; 3) review and test the scripts locally (they are plain JS) to ensure the target paths and templates match your repo layout; 4) be aware it runs `openclaw plugins list` (executes a shell command) and will create files under your home directory; and 5) if you want manual approval, modify SKILL.md or the orchestration policy so the skill asks before writing. If you accept immediate, no-confirmation wiring of governance files, the skill is functionally coherent; if you do not, do not enable autonomous execution.

Type: OpenClaw Skill Name: rule-creation Version: 1.1.0 The skill is designed to automate rule creation and enforcement. However, the `scripts/create-lobster-workflow.js` script takes user-provided `RULE_DESCRIPTION` and embeds it directly into the `templates/lobster-workflow.template.lobster` file without sanitization. Since the `.lobster` files contain `command: |` blocks intended for shell execution by the Lobster plugin, this creates a critical shell injection vulnerability (RCE risk). An attacker could provide a malicious `RULE_DESCRIPTION` containing shell metacharacters (e.g., `'; rm -rf /'`) which would then be executed by the Lobster plugin when the generated workflow is run. This is a vulnerability that allows attacks, classifying the skill as suspicious.