Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Dify Workflow DSL Expert
v1.3.0Use when creating, editing, debugging, or validating Dify workflow DSL for self-hosted Dify. Start from an exported workflow of the target instance, edit min...
⭐ 0· 82·0 current·0 all-time
byAlexander Schneider@arn0ld87
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, templates, references, and the two helper scripts (ID generator and validator) match the claimed purpose of authoring and locally validating Dify workflow DSL for self-hosted Dify. There are no unrelated environment variables, binaries, or install steps declared that would contradict the stated scope.
Instruction Scope
SKILL.md stays narrowly focused on workflow DSL editing, minimal edits, local YAML validation, and re-import checks. It explicitly forbids embedding secrets in DSL. However, the instructions and README recommend running scripts/validate_workflow.py and the included scripts are part of the distributed package — you should inspect those scripts because a validator could (intentionally or accidentally) execute code nodes, open files, or make network requests during validation. SKILL.md itself does not instruct reading unrelated system config or environment variables.
Install Mechanism
No install spec — instruction-only with packaged reference files and scripts. That lowers supply-chain risk. The package contents are local files and templates from the skill; nothing is fetched from remote URLs during install.
Credentials
The skill declares no required environment variables, credentials, or config paths. This is proportionate to a DSL authoring/validation tool. Note: some example workflows reference third-party model providers (Anthropic/claude) in templates, but those are examples and do not constitute requested secrets.
Persistence & Privilege
Skill flags show no elevated persistence (always: false). It does not request to modify other skills or system-wide settings. Autonomous invocation is allowed by default, which is normal; this only increases blast radius if the included scripts are dangerous — see instruction_scope note.
What to consider before installing
This package is largely consistent with its stated goal of helping edit and validate Dify workflow DSL. Before using it: 1) Review scripts/validate_workflow.py and scripts/generate_id.py to confirm they only perform static checks and do not execute arbitrary user-provided code, spawn subprocesses, or make network calls. 2) Run any validation scripts in a sandboxed environment (container or VM) when validating untrusted exports. 3) Do not provide production instance credentials to the skill; instead supply exported DSL files as directed. 4) Treat templates and example workflows as drafts — follow the skill's 'export-first' guidance and never blindly import into a live system without backups. If you want, paste the contents of scripts/validate_workflow.py here and I can review them for risky operations (network access, subprocess, exec/eval, file writes, or importing unusual modules).Like a lobster shell, security has layers — review code before you run it.
latestvk97awhbyaqr2bn2n445t1n2z6983b8jy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.