Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FlowForge

v1.0.0

Run structured multi-step workflows via FlowForge engine. Use when user requests step-by-step execution, structured workflows, or when a task needs enforced...

0· 96·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kagura-agent/kagura-flowforge.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "FlowForge" (kagura-agent/kagura-flowforge) from ClawHub.
Skill page: https://clawhub.ai/kagura-agent/kagura-flowforge
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kagura-flowforge

ClawHub CLI

Package manager switcher

npx clawhub@latest install kagura-flowforge
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes a FlowForge workflow runner and expects a FlowForge CLI (npm package @kagura-agent/flowforge). That purpose matches the instructions (list/start/status/next/log, local workflows), however the skill's registry metadata did not declare the CLI or any required binaries — a discrepancy that should have been declared. Otherwise requested capabilities (local file access, ~/.flowforge DB) align with the stated purpose.
!
Instruction Scope
The SKILL.md instructs the agent to run arbitrary FlowForge CLI commands and to execute node 'task' text (which can include reading files, running tests, making PRs, etc.) — expected for a runner. More concerning: a 'self-updating rule' tells the agent to edit this SKILL.md (add intent→workflow mappings and update YAML frontmatter) and the setup suggests editing AGENTS.md/CLAUDE.md. That instructs the agent to modify the installed skill and workspace agent-steering files, which is scope creep and increases risk (persisted changes to activation behavior).
Install Mechanism
There is no formal install spec in the registry (instruction-only). setup.md tells users to install the CLI via `npm install -g @kagura-agent/flowforge`. An npm global install is a moderate-risk action if the package origin and contents are not verified; the skill itself does not bundle or declare the CLI dependency in metadata.
Credentials
The skill requests no environment variables or external credentials. It does write to and read from local/workspace paths (~/.flowforge, ./workflows, workflows/), which is appropriate for a local workflow engine. No unrelated secrets or service tokens are requested.
!
Persistence & Privilege
The skill does not set always:true, but it explicitly instructs agents to persist mappings by editing SKILL.md frontmatter and to add steering entries to AGENTS.md, which effectively increases future activation and persistence. Directing autonomous edits to the skill's own files and agent steering docs is a notable privilege escalation (ability to change how/when the skill is invoked).
What to consider before installing
This skill looks coherent for running local, multi-step workflows, but exercise caution before installing and letting an agent run it autonomously. Specific recommendations: - Verify the FlowForge CLI package (@kagura-agent/flowforge) on npm (author, source repo, code) before running `npm install -g`. - Do not grant an agent blanket write permission to installed skill files or workspace agent-steering docs if you are uncomfortable with autonomous edits; consider removing or disabling the 'self-updating' rule and instead maintain intent→workflow mappings manually. - Run the CLI in a controlled/sandboxed account (non-root) and review ~/.flowforge contents; back up or isolate any sensitive data before use. - Audit any workflows you add or accept to ensure they don't instruct the agent to exfiltrate secrets or perform network operations you didn't intend. - Ask the publisher (or inspect source) to update registry metadata to declare the required CLI/binaries explicitly so dependency expectations are clear. If you want to proceed safely: install the CLI only after review, disable automatic edits to SKILL.md/AGENTS.md, and test the flowforge CLI locally without giving agents automatic permission to modify skill files.

Like a lobster shell, security has layers — review code before you run it.

latestvk9794k34d3mw9yanqhv2aste9x83wxk3
96downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

FlowForge Workflow Runner

Execute multi-step workflows defined in YAML files using the FlowForge state machine engine.

Prerequisites

FlowForge CLI must be installed. Check with:

flowforge --version

If the command fails or is not found, run the setup flow in setup.md before proceeding. Setup will install the CLI, create the workflows directory, and configure your workspace.

When to Use FlowForge

Use FlowForge when:

  • User explicitly requests "workflow", "step by step", or "use flowforge"
  • Task has multiple sequential steps that shouldn't be skipped
  • User wants enforced execution order (e.g., always test before submit)
  • Task involves state that needs to persist across sessions

Don't use for simple one-off tasks or quick questions.

My Workflows

<!-- This table maps user intents to workflow names. --> <!-- When you notice the same intent matching the same workflow 2-3 times, add it here. --> <!-- This saves a `flowforge list` lookup every time and makes triggering instant. -->
IntentWorkflow
(add your mappings here as you use FlowForge)

Self-updating rule: When you match an intent to a workflow via flowforge list and it works well, add that mapping to the table above. Then update the description field in the YAML frontmatter at the top of this file to include the new trigger phrase — this is how OpenClaw knows when to activate this skill.

Core Workflow

1. Find the Right Workflow

First check the My Workflows table above. If the user's intent matches an entry, use it directly.

If no match, fall back to discovery:

flowforge list

If no workflow matches user's intent, help them create one (see yaml-format.md).

2. Start or Resume

# Check for active instances
flowforge active

# If active instance exists → resume
flowforge status

# If no active instance → start new
flowforge start <workflow-name>

3. Execute Current Node

After flowforge status, you'll see:

  • Current node name
  • Task (natural language instruction)
  • Next node or branches

Execute the task as described. The task field tells you exactly what to do.

For complex implementation tasks: delegate to appropriate tools or sub-agents. For simple tasks: execute directly.

4. Advance to Next Node

After completing the task:

# Linear flow (no branches)
flowforge next

# Branching flow (multiple paths)
flowforge next --branch 1   # first condition
flowforge next --branch 2   # second condition

5. Repeat Until Complete

Continue the cycle:

  1. flowforge status — see current task
  2. Execute the task
  3. flowforge next — advance
  4. Repeat until terminal node

6. View History

flowforge log

Shows all nodes visited with timestamps.

Creating New Workflows

If user needs a workflow that doesn't exist:

  1. Ask about their process steps
  2. Draft a YAML file (see yaml-format.md)
  3. Save to workflows/ directory or workspace
  4. Register with flowforge define workflow.yaml

See references/examples/ for templates.

YAML Format Quick Reference

name: workflow-name
description: What this workflow does
start: first-node

nodes:
  first-node:
    task: Description of what to do
    next: second-node

  second-node:
    task: Another task
    branches:
      - condition: success
        next: final-node
      - condition: failure
        next: first-node

  final-node:
    task: Wrap up and report
    terminal: true

Node Fields

  • task: Natural language instruction (required)
  • next: Single next node for linear flow
  • branches: Array of {condition, next} for branching
  • terminal: Set to true for end nodes

Rules

  • Never skip nodes. Execute every node's task before advancing.
  • Always check status. Don't assume position — run flowforge status.
  • One task at a time. Complete current node before looking ahead.
  • Post-run. When a workflow reaches a terminal node, record what was done and the outcome. If your workspace has a memory or log system, write results there.
  • State persists. Workflows survive session restarts.
  • Use reset sparingly. Only reset if workflow is stuck or user requests it.

Advanced Usage

Multiple Workflows

If user has multiple active workflows:

flowforge active  # list all
flowforge status  # shows current default

Reset Current Workflow

flowforge reset

Creates new instance from start node. Old history is preserved.

Workflow Discovery

FlowForge auto-loads YAML files from:

  • ./workflows/ in current directory
  • ~/.flowforge/workflows/ in home directory

Users can drop workflow files into these directories and they're automatically available — no need to run flowforge define.

Examples

Example 1: Code Contribution

User: "Help me contribute to this project"

  1. Check if contribution workflow exists: flowforge list
  2. Start: flowforge start code-contribution
  3. Execute each node:
    • study → read project structure
    • implement → write code
    • test → run tests
    • submit → create PR
    • verify → address feedback

Example 2: Learning Workflow

User: "I want to study React hooks step by step"

  1. Check for study workflow: flowforge list
  2. If exists: flowforge start study
  3. If not: help create YAML with nodes like:
    • discover → find resources
    • deep-read → read documentation
    • practice → write examples
    • reflect → note key concepts

Example 3: Resume Interrupted Work

User returns after session ended mid-workflow:

  1. flowforge active → shows interrupted workflow
  2. flowforge status → shows current node
  3. Continue from there

Troubleshooting

"No active instance": Run flowforge start <workflow>

"Workflow not found": Run flowforge list to see available workflows

Wrong node/stuck: Use flowforge reset to restart workflow

Need to modify workflow: Edit YAML file, run flowforge define workflow.yaml to update

See Also

Comments

Loading comments...