by 安全扫描
OpenClaw
可疑
medium confidenceThe package largely matches its advertised automation features, but there are inconsistencies around credential handling and real external integrations that a user should understand before trusting it in production.
评估建议
This package provides a full local implementation of a workflow engine and simulated connectors for many Chinese platforms, but it does not declare or manage real OAuth credentials or other secrets. If you plan to connect it to production accounts, you will need to supply proper client IDs/secrets and a secure token storage mechanism yourself — the skill currently simulates authorization and returns in-memory tokens. Before installing or granting any access: (1) confirm whether the distributed c...详细分析 ▾
ℹ 用途与能力
The code implements a workflow engine, connector manager, AI flow generator, template center, execution monitor and permission manager consistent with the 'cross-platform automation' description. However, the skill advertises integrations with real services (WeChat, DingTalk, Feishu, WPS, Tencent Docs, Aliyun Drive) while requesting no environment variables or credentials. Real OAuth client IDs/secrets or API keys are not declared/required by the skill metadata, which is surprising for a tool that claims to perform live cross-platform operations.
✓ 指令范围
SKILL.md and README contain only usage instructions such as 'pip install -r requirements.txt' and run examples/tests. The runtime instructions and examples operate on the packaged Python modules and simulated authorization flows; they do not instruct the agent to read unrelated system files, environment variables, or to exfiltrate data. There are no directives that expand scope unexpectedly.
✓ 安装机制
There is no install spec in the registry (instruction-only). The package ships source files and a requirements.txt listing common libraries (requests, pyyaml, python-dateutil, schedule). No remote download URLs, archive extraction, or unusual installation steps are present.
⚠ 凭证需求
The skill declares no required environment variables or primary credential, yet it claims to integrate with OAuth-based services. Connector configuration (config/connectors.yaml) lists auth_url and api_base endpoints but no client_id/client_secret handling. The ConnectorManager.authorize(...) method simulates token issuance rather than performing a real OAuth flow. If a user expects live integrations, additional secrets and secure storage will be required — those are not requested or documented by the skill metadata, which may mislead non-technical installers.
✓ 持久化与权限
Registry flags are default (always:false, agent can invoke autonomously). The code stores auth tokens in memory (ConnectorManager.auths) and does not appear to modify other skills or agent-wide configuration. There is no evidence the skill requests permanent elevated platform presence.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/14
零代码跨生态自动化Skill - 支持微信、钉钉、飞书、WPS等国内生态，AI自动生成流程，11个预设模板
● 无害
安装命令 点击复制
官方npx clawhub@latest install clawhub-automation
镜像加速npx clawhub@latest install clawhub-automation --registry https://cn.clawhub-mirror.com
技能文档
让无代码基础的用户也能在3分钟内搭建跨平台自动化流程，连接微信、钉钉、飞书、WPS等国内主流生态。
核心功能
| 功能模块 | 说明 |
|---|---|
| 国内生态接口对接 | 微信、钉钉、飞书、WPS、腾讯文档、阿里云盘 |
| 零代码流程配置 | 可视化拖拽，3分钟完成配置 |
| AI流程智能生成 | 自然语言指令自动生成流程 |
| 执行监控与兜底 | 与重试降级Skill联动，成功率≥95% |
| 模板中心 | 50+高频场景模板一键复用 |
快速开始
from scripts.workflow_engine import WorkflowEngine
from scripts.ai_flow_generator import AIFlowGenerator# AI生成流程
ai_gen = AIFlowGenerator()
workflow = ai_gen.generate("微信收到文件自动同步到阿里云盘")
# 执行流程
engine = WorkflowEngine()
engine.run(workflow)
安装
pip install -r requirements.txt
项目结构
clawhub-automation/
├── SKILL.md # Skill说明
├── README.md # 完整文档
├── requirements.txt # 依赖
├── config/
│ └── connectors.yaml # 生态连接器配置
├── scripts/ # 核心模块
│ ├── workflow_engine.py # 流程引擎
│ ├── connector_manager.py # 生态连接器
│ ├── ai_flow_generator.py # AI流程生成
│ ├── template_center.py # 模板中心
│ ├── execution_monitor.py # 执行监控
│ └── permission_manager.py # 权限管理
├── templates/ # 场景模板
├── examples/ # 使用示例
└── tests/ # 单元测试
运行测试
cd tests
python test_automation.py
详细文档
请参考 README.md 获取完整API文档和使用指南。
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制