by 安全扫描
OpenClaw
安全
medium confidenceThe skill's code and instructions align with its stated purpose as a demo/no‑code automation framework, but it simulates platform authorization and does not request real credentials — review omitted files and how you would supply real OAuth secrets before using in production.
评估建议
This package appears to be a self‑contained demo framework that simulates connectors rather than performing real OAuth/API calls. Before installing or using it in production: 1) inspect the omitted/full files (workflow_engine, permission_manager, template_center) for any network calls, filesystem access, or hardcoded endpoints; 2) if you intend to connect real services, plan to provide proper OAuth client IDs/secrets and implement secure storage (the skill currently does not request them); 3) ru...详细分析 ▾
ℹ 用途与能力
Name/description promise real cross‑platform integration (WeChat, DingTalk, Feishu, WPS, Tencent Docs, Aliyun Drive). The included code defines connectors and OAuth endpoints, but the connector implementation simulates authorization/token issuance in memory and no environment variables or client secrets are requested. This is coherent for a local demo or simulator, but would be incomplete for a production connector that must store client IDs/secrets and perform real HTTP OAuth flows.
✓ 指令范围
SKILL.md and README instruct running tests, pip installing requirements, and importing the package. The runtime instructions do not tell the agent to read system files, secrets, or send data to unexpected external endpoints. Example code manipulates sys.path to import local scripts (normal for examples).
✓ 安装机制
No install spec; code is delivered in the skill bundle and requirements.txt lists common libraries (requests, pyyaml, python-dateutil, schedule). No downloads from arbitrary URLs or archive extraction were specified. Risk from installation is typical for third‑party Python code (review before pip installing).
ℹ 凭证需求
The skill requests no environment variables or external credentials even though its declared purpose is integrating with external platforms that normally require OAuth client IDs/secrets. The provided connector code creates mock tokens in memory rather than performing authenticated network exchanges — acceptable for a demo but incomplete for real integrations. No unrelated secrets or config paths are requested.
✓ 持久化与权限
Skill is not always‑on and uses default agent invocation settings. It does not request or attempt to modify other skills' configurations. There is no evidence of writing persistent system‑wide configuration or elevating privileges in the visible code.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/16
Initial release: 零代码跨生态自动化工具，支持微信/钉钉/飞书/WPS集成
● 无害
安装命令 点击复制
官方npx clawhub@latest install flowbridge
镜像加速npx clawhub@latest install flowbridge --registry https://cn.clawhub-mirror.com
技能文档
让无代码基础的用户也能在3分钟内搭建跨平台自动化流程，连接微信、钉钉、飞书、WPS等国内主流生态。
核心功能
| 功能模块 | 说明 |
|---|---|
| 国内生态接口对接 | 微信、钉钉、飞书、WPS、腾讯文档、阿里云盘 |
| 零代码流程配置 | 可视化拖拽，3分钟完成配置 |
| AI流程智能生成 | 自然语言指令自动生成流程 |
| 执行监控与兜底 | 与重试降级Skill联动，成功率≥95% |
| 模板中心 | 50+高频场景模板一键复用 |
快速开始
from scripts.workflow_engine import WorkflowEngine
from scripts.ai_flow_generator import AIFlowGenerator# AI生成流程
ai_gen = AIFlowGenerator()
workflow = ai_gen.generate("微信收到文件自动同步到阿里云盘")
# 执行流程
engine = WorkflowEngine()
engine.run(workflow)
安装
pip install -r requirements.txt
项目结构
clawhub-automation/
├── SKILL.md # Skill说明
├── README.md # 完整文档
├── requirements.txt # 依赖
├── config/
│ └── connectors.yaml # 生态连接器配置
├── scripts/ # 核心模块
│ ├── workflow_engine.py # 流程引擎
│ ├── connector_manager.py # 生态连接器
│ ├── ai_flow_generator.py # AI流程生成
│ ├── template_center.py # 模板中心
│ ├── execution_monitor.py # 执行监控
│ └── permission_manager.py # 权限管理
├── templates/ # 场景模板
├── examples/ # 使用示例
└── tests/ # 单元测试
运行测试
cd tests
python test_automation.py
详细文档
请参考 README.md 获取完整API文档和使用指南。
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制