Workflow

Build automated pipelines with reusable components, data flow between nodes, and state management.

Install only if you are comfortable treating this as workflow-authoring guidance that must be reviewed before execution. Do not expose the webhook example as written; add strict workflow-name allowlisting, resolved-path checks, signature and timestamp verification, and explicit user approval before running any selected workflow. Use least-privilege tokens, review generated run.sh files with dry-run first, and replace broad cron/removal/deletion examples with scoped, reversible procedures.

Type: OpenClaw Skill Name: workflow Version: 1.0.0 The skill bundle is primarily documentation for building automated workflows using standard Unix tools. It is classified as 'suspicious' due to a critical shell injection vulnerability identified in the `components.md` file, specifically within the 'Webhook Router (webhook-server.sh)' example. The example code directly uses an unsanitized `PATH` variable, derived from an incoming webhook request, to construct a `WORKFLOW` variable which is then used in a `cd` command and to execute `./run.sh`. This allows an attacker to inject arbitrary shell commands via the webhook path, leading to potential Remote Code Execution (RCE) if this example is implemented without proper input sanitization. There is no evidence of intentional malicious behavior, but this is a severe vulnerability.