Durable Workflow
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This skill appears purpose-aligned and benign, with optional Node.js workflow templates that create local state, output, dead-letter, and lock files when used.
This skill is reasonable to install if you want workflow-resilience patterns. Before running the optional scripts, review and edit the TODO sections, run them with normal user privileges, choose dedicated paths for state/DLQ/lock files, and avoid persisting secrets or sensitive records unless you have protected those files.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the lock helper is run with a bad path, it could overwrite or remove a local file intended to be used as the lock file.
The lock helper writes to and later removes the caller-supplied lock path. This is expected for a lock-file utility, but an unsafe or untrusted path could affect the wrong local file.
const absPath = path.resolve(lockPath); ... fs.renameSync(tmpPath, absPath); ... fs.unlinkSync(absPath);
Use a dedicated lock-file path in a temporary or application-specific directory, and do not pass untrusted or protected file paths to the lock helper.
Workflow inputs, processed items, errors, or stack traces may remain on disk and can affect future resumed runs.
The template persists workflow state and failed items, including error messages and stack traces. This is central to durable workflows, but the files may contain sensitive workflow data and are reused across runs.
const STATE_PATH = process.env.WORKFLOW_STATE_PATH || 'workflow-state.json';
const DLQ_PATH = process.env.WORKFLOW_DLQ_PATH || 'workflow-dlq.json';
... existing.push({ item, error: error.message, stack: error.stack, failedAt: new Date().toISOString() });Store state and DLQ files in protected locations, avoid writing secrets into them, delete them when no longer needed, and add validation before trusting persisted state in production workflows.