Auto Workflow Builder
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is a sparse instruction-only workflow automation stub with no malicious behavior shown, but users should verify any helper script and tightly scope automated actions.
Before installing or using this skill, verify the source of any workflow.sh implementation, understand how workflows are stored and stopped, and approve each integration or scheduled action before connecting it to real services.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If a user follows the example, they may run a local script that was not included or reviewed with this skill.
The quick start depends on a local workflow.sh executable, but the provided manifest contains only SKILL.md and _meta.json and there is no install spec. This is a provenance/completeness issue rather than evidence of malicious behavior.
./workflow.sh create my-workflow
Only run a workflow.sh script if you know its source and have reviewed or trust it; the skill package should ideally include or clearly link its implementation.
A workflow could send communications, call external services, or change data if configured with real integrations.
The skill describes workflow actions that can send messages, call APIs, and operate on databases. These are expected for an automation builder, but they can have real external effects if connected to live systems.
- **Actions** - Send email, HTTP requests, database operations
Require explicit review before enabling workflows that write to databases, send messages, invoke cloud functions, or call sensitive APIs.
A scheduled workflow may continue running repeatedly after initial setup.
The example configures a recurring scheduled trigger. Persistent scheduling is disclosed and purpose-aligned, but users should ensure workflows can be stopped and audited.
./workflow.sh add-trigger my-workflow schedule "*/5 * * * *"
Confirm how to list, pause, disable, and delete workflows before using recurring triggers.