SoulFlow — Agent Teams Workflow Skill

General-purpose AI workflow framework for OpenClaw. Build custom multi-step workflows for any task — dev, ops, research, content, or automation. Ships with dev workflow examples.

This skill is functionally coherent but requests powerful, persistent privileges. Before installing or running it: 1) Review the code (especially lib/runner.js and lib/gateway.js) and any workflows you will run. 2) Backup ~/.openclaw/openclaw.json and inspect authProfiles; consider removing sensitive authProfiles or creating a limited account for testing. 3) Be cautious: the worker inherits other agents' authProfiles and can access external services (GitHub, cloud). 4) Prefer running in an isolated/test OpenClaw instance or sandboxed user account first. 5) Only run workflows you (or trusted collaborators) author; inspect any third-party .workflow.json before execution. If you cannot inspect code or do not trust the author, avoid installing this skill.

Type: OpenClaw Skill Name: soulflow Version: 1.1.2 The skill is classified as suspicious due to its extremely broad permissions and capabilities, which, while explicitly declared, present a significant attack surface. The `SKILL.md` and `README.md` clearly state that the skill creates a `soulflow-worker` agent with 'full tool access' (read, write, edit, exec, browser) and 'inherits authProfiles' (credentials) from existing agents. Workflows, such as `security-audit.workflow.json` and `deploy-pipeline.workflow.json`, directly instruct the worker agent to use `exec` for arbitrary command execution. While the documentation transparently warns users about these risks and the need to trust the skill author and custom workflows, the inherent power to perform RCE, access credentials, and modify the system (via `config.patch` in `lib/runner.js` to create agents) elevates it beyond benign, even without clear evidence of intentional malicious self-exploitation by the author.