Workflows

Playbook for authoring, running, evaluating, and improving Gina sandbox workflows with safe defaults and repeatable operations.

This is a coherent operations playbook for creating and running sandbox workflows. It does describe and rely on workflow step capabilities that can execute shell commands, read and write files, and access KV/SQL; those are normal for a workflow system but mean you should never run unreviewed workflows. Before installing/using: (1) Confirm the 'workflow' CLI/runtime you will call is the expected/trusted tool on your system, (2) review any .ts workflow definitions in /workspace/.harness/workflows for untrusted exec/fs/kv usage, (3) keep secrets out of workflow code and logs, and (4) require explicit permission scopes and least privilege for any steps that perform writes or external actions.

Type: OpenClaw Skill Name: workflows Version: 1.0.2 The skill bundle is classified as suspicious due to the explicit documentation of powerful execution capabilities within workflow steps, which, when combined with input interpolation, creates a high risk of severe injection vulnerabilities. Specifically, `references/cli-and-definition.md` details `type: "ts"` steps with `exec(command)`, `fs.promises.*`, and `sql(query)` access, as well as `type: "bash"` and `type: "host"` steps. The `{{inputs.symbol}}` template syntax allows user input to be directly interpolated into these commands, enabling potential Remote Code Execution (RCE), SQL Injection (SQLi), and arbitrary file access if workflow authors do not implement robust input sanitization. While the skill itself is a playbook for workflow management and does not demonstrate malicious intent, it provides the building blocks and documentation for creating highly vulnerable workflows.