FlowFi

REST API instructions for FlowFi—authorization, smart accounts, workflows (AI generate, edit, deploy, undeploy, delete, pause, resume, stop), execution (list...

Security Scan

The skill is an instruction-only API reference for the FlowFi backend and its requested capabilities and instructions are coherent with that purpose.

Purpose & Capability

The name/description describe a REST/WebSocket API for workflow management; the files only contain API docs and example endpoints. There are no unrelated binaries, installs, or credentials requested, so required resources are proportionate to the stated purpose.

Instruction Scope

SKILL.md and the docs restrict actions to calling FlowFi REST endpoints and WebSocket messages using a user-supplied JWT. The instructions do not direct reading local files, environment variables, or other system state, nor do they instruct exfiltration to unexpected endpoints. They do allow writing changes to the backend (e.g., deploy, delete, clone, workflow:update) which is expected for this API.

Install Mechanism

No install spec and no code files — this is instruction-only and nothing is written to disk or downloaded during install.

Credentials

The skill declares no required env vars or credentials. It expects the user to supply a JWT for protected routes, which is appropriate for an API-integration doc. No unrelated secrets or multiple unrelated credentials are requested.

Persistence & Privilege

always is false and the skill does not request persistent or elevated platform privileges. It does describe API actions that are destructive (delete, deploy, clone) but those are legitimate parts of the described API and operate against the remote backend only.

Assessment

This doc-only skill appears to be a straightforward API reference. Before using it, only provide a JWT you trust and understand the token's scope/expiry (prefer short-lived or scoped tokens). Be aware that many endpoints are destructive (DELETE /workflows/:id, POST /workflows/:id/deploy, POST /templates/:id/clone, WebSocket workflow:update) so any automated agent using this skill can change or remove workflows on your backend. Confirm the correct base URL for your environment (docs show different example domains) and avoid handing over tokens with broad/long-lived permissions unless you intend the agent to operate with those privileges.

FlowFi OpenClaw skill

Instructions for the FlowFi backend API. Base URL is the backend API root (e.g. https://api.seimoney.link). Protected routes use JWT via Authorization: Bearer <token>.

Grouped docs (content split by topic):

Topic	File
Authorization	docs/authorization.md
Smart accounts	docs/smart-accounts.md
AI workflows (generate, suggestions, edit by prompt)	docs/ai-workflows.md
Workflows (lifecycle, deploy/undeploy/pause/resume/stop/delete, list, draft)	docs/workflows.md
DTOs & request/response shapes	docs/dto.md
Execution (REST)	docs/execution.md
WebSocket (real-time)	docs/websocket.md
Price	docs/price.md
Templates	docs/templates.md
Endpoint summary table	docs/summary.md

See docs/README.md for the full index.

Quick entry points: Generate workflow → POST /ai/generate-workflow (prompt + smartAccountId). Deploy → POST /workflows/:id/deploy. List workflows → GET /workflows. Real-time → WebSocket namespace /workflow-status; subscribe to execution/workflow/simulation.