coze-workflow-runner

调用 Coze 工作流执行自动化任务，支持生成图片、处理数据等操作

Security Scan

The skill's stated purpose (call Coze workflows) matches the code, but there are suspicious/incoherent details: an undeclared credential file, a hard-coded user-specific token path that differs from the SKILL.md path, and no declared dependency information — these inconsistencies could lead to token exposure or unexpected behavior.

Purpose & Capability

The skill claims only to call Coze workflows and provide examples for image/text workflows, which matches included code that uses the cozepy client. However, the skill declares no required credentials/config, yet both SKILL.md and the script expect a local token file. The script hardcodes a user-specific path (/Users/hanjin/.openclaw/workspace-prod/coze/coze-tokens.md) while SKILL.md references ~/workspace-prod/coze/coze-tokens.md — this mismatch and the omission of the token as a declared requirement is incoherent.

Instruction Scope

Instructions direct the agent to read a local tokens file and a workflows file and to follow shortlink redirects and download images via curl. Reading a token file and writing downloaded images is within the skill's purpose, but the script reads a hardcoded path in another user's dot-directory which is outside the documented workspace path. That behavior increases the chance of reading unrelated/privileged secrets and is not documented in requires/config.

Install Mechanism

There is no install spec (instruction-only plus a helper script). This minimizes install-time risk. Note: the skill depends on the cozepy library and curl being available, but these dependencies are not declared.

Credentials

No environment variables or credentials are declared in metadata, yet the runtime expects a service token stored in a local file. The script looks for lines containing 'Bearer' and 'sat_' — i.e., a credential-like token — but this credential isn't declared as primaryEnv or required config. Requiring access to a token file without declaring it is disproportionate and raises risk of silent credential access/exfiltration.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills' configs. Autonomous invocation is allowed (platform default) but not combined with other high-privilege flags.

What to consider before installing

Things to check before installing or running this skill: - Confirm where your Coze service token is stored. The SKILL.md says ~/workspace-prod/coze/coze-tokens.md but the script reads /Users/hanjin/.openclaw/... — that hardcoded developer path is suspicious. Do NOT place high-privilege tokens in a file that this script might read. Use a dedicated service token with limited scope. - Ask the author to declare the credential (primaryEnv or required config path) and to remove hardcoded, user-specific paths. Prefer explicit configuration (env var or configurable path) over hardcoded filesystem locations. - Verify dependencies (cozepy, curl) will be available in your runtime; missing deps could cause fallback behaviors. - Be cautious about automatic downloads of workflow output URLs: outputs are short links and the skill's instructions and script will follow redirects and download content. Review outputs before auto-downloading to avoid fetching malicious payloads. - If you must run it, run in an isolated environment (throwaway account or container) and inspect the token file contents and code modifications first. If the developer cannot explain the path mismatch, treat it as unsafe.

Coze 工作流运行器

概述

通过 Coze API 调用工作流，执行自动化任务。目前支持生成宠物知识卡片等图像生成工作流。

快速开始

1. 配置令牌

服务令牌存储在：~/workspace-prod/coze/coze-tokens.md

首次使用时确认令牌有效。

2. 查看可用工作流

工作流列表存储在：~/workspace-prod/coze/workflows.md

包含每个工作流的 ID、链接和用途说明。

3. 调用工作流

使用 cozepy 库调用：

import cozepy

# 认证
auth = cozepy.TokenAuth(token='你的服务令牌')
coze = cozepy.Coze(auth=auth, base_url='https://api.coze.cn')

# 调用工作流
response = coze.workflows.runs.create(
    workflow_id='工作流ID',
    parameters={'input': '输入参数'}
)

现有工作流

短视频文案拆解（13层逻辑）

• 工作流 ID: 7610429408704413759
• 用途: 通过13层逻辑拆解短视频文案，输入抖音口令链接即可提取并分析底层逻辑
• 输入: 抖音口令链接（如 7:/ xxx）
• 返回: 短视频文案内容 + 13层逻辑拆解结果

调用示例:

import cozepy

auth = cozepy.TokenAuth(token='你的服务令牌')
coze = cozepy.Coze(auth=auth, base_url='https://api.coze.cn')

response = coze.workflows.runs.create(
    workflow_id='7610429408704413759',
    parameters={'input': '7:/ xxx:】'}
)

生成宠物知识卡片

• 工作流 ID: 7610527662062665754
• 用途: 生成宠物知识卡片图片（5张）
• 输入: 宠物名称和描述文本
• 返回: 5个图片 URL（短链接形式）

调用示例:

import cozepy

auth = cozepy.TokenAuth(token='你的服务令牌')
coze = cozepy.Coze(auth=auth, base_url='https://api.coze.cn')

response = coze.workflows.runs.create(
    workflow_id='7610527662062665754',
    parameters={'input': '布偶猫宠物知识卡片：布偶猫又称布拉多尔猫，是体型和体重最大的猫品种之一。'}
)

# 返回: {"output": ["https://s.coze.cn/t/xxx/", ...]}

处理返回的短链接

工作流返回的是短链接，需要跟随跳转才能获取真实图片 URL：

import subprocess

urls = response['data']['output']
for i, url in enumerate(urls, 1):
    # curl -L 自动跟随跳转，直接下载图片
    subprocess.run(['curl', '-sL', url, '-o', f'pet_card_{i}.png'])

资源

配置目录

• ~/workspace-prod/coze/coze-tokens.md - 服务令牌
• ~/workspace-prod/coze/workflows.md - 工作流列表

---

最后更新：2026-03-24