技能详情（站内镜像，无评论）
作者：Anil Chandra Naidu Matcha @anil-matcha
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.0
统计：⭐ 0 · 115 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：anil-matcha/muapi-workflow-skill
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill generally matches its stated purpose (wrapping a muapi CLI to build/run workflows) but contains instructions that could install arbitrary code and includes an easy-to-miss exfiltration vector (webhook support), so it needs closer review before use.
目的
The name/description (build and run muapi workflows) align with the included shell wrappers that call `muapi workflow ...`. However the skill does not declare that the `muapi` CLI is required in its registry metadata even though every script depends on it; the SKILL.md additionally instructs reinstalling a local `muapi-cli` source tree, which is unusual and should have been declared.
说明范围
The SKILL.md directs the agent to 'reinstall from source at the start of every session' via `pip install --upgrade /path/to/muapi-cli` (a path in the workspace). That instruction effectively tells the agent to run package installation of arbitrary local code each session, which can result in arbitrary code execution. Otherwise the runtime instructions are scoped to listing, creating, editing, and running workflows and specify that the agent mu…
安装机制
There is no formal install spec, but the guidance to run `pip install --upgrade /path/to/muapi-cli` is a high-risk install pattern because it installs code from an unspecified local path (workspace). This will write and execute code on the agent environment and was not codified in the registry metadata; no checksums or known release sources are provided.
证书
The skill requests no env vars, which is reasonable, but the run wrapper accepts a `--webhook` argument and forwards it to `muapi workflow execute`. That provides a straightforward channel to send workflow outputs to an arbitrary external endpoint if used — a possible exfiltration vector. Combined with the SKILL.md's install-from-workspace instruction, the overall credential/IO surface is larger than the description suggests.
持久
The skill does not request permanent presence (always:false), does not modify other skills, and contains only small shell wrappers. It doesn't request elevated platform privileges in the manifest.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Workflow」。简介：Build, run, and visualize multi-step AI generation workflows. The AI architect …。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/anil-matcha/muapi-workflow-skill/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。