feat(skill): finish n8n webhook skill

skills/n8n-webhook/SKILL.md

@@ -20,7 +20,18 @@ Keep the integration narrow: let OpenClaw decide what to do, and let n8n execute
 4. Use header auth by default (`x-openclaw-secret`).
 5. Use `/webhook-test/` only while building/editing a workflow.
 6. Surface non-2xx responses clearly instead of pretending success.
-7. If a new workflow is needed, define its request/response contract before wiring callers.
+7. Keep secrets in n8n credentials or local env vars, never inside shareable workflow JSON.
+8. If a new workflow is needed, define its request/response contract before wiring callers.
+
+## What ships with this skill
+
+- direct webhook caller: `scripts/call-webhook.sh`
+- action-bus caller: `scripts/call-action.sh`
+- workflow validator: `scripts/validate-workflow.py`
+- importable router workflow: `assets/openclaw-action.workflow.json`
+- sample payloads:
+  - `assets/test-append-log.json`
+  - `assets/test-notify.json`
 
 ## Quick usage
 
@@ -39,7 +50,7 @@ scripts/call-webhook.sh openclaw-ping --data '{"message":"hello from OpenClaw"}'
 Call the preferred action-bus route:
 
 ```bash
-scripts/call-action.sh append_log --args '{"text":"backup complete"}'
+scripts/call-action.sh append_log --args '{"text":"backup complete"}' --request-id auto
 ```
 
 Call a test webhook while editing a flow:
@@ -48,6 +59,12 @@ Call a test webhook while editing a flow:
 scripts/call-action.sh notify --args '{"message":"hello from OpenClaw"}' --test --pretty
 ```
 
+Validate the shipped workflow asset:
+
+```bash
+python3 scripts/validate-workflow.py assets/openclaw-action.workflow.json
+```
+
 ## Workflow
 
 ### Call an existing safe webhook directly
@@ -76,12 +93,28 @@ Payload shape:
 
 This keeps the external surface small while letting n8n route internally.
 
+### Import the shipped router workflow
+
+Use the included workflow asset when you want a ready-made starter router for:
+
+- `append_log`
+- `notify`
+- normalized JSON success/failure responses
+- unknown-action handling
+
+Important:
+- the workflow export intentionally leaves Webhook authentication unset
+- after import, manually set **Authentication = Header Auth** on the Webhook node and bind a local credential using `x-openclaw-secret`
+
+See `references/openclaw-action.md` for import and test steps.
+
 ### Add a new webhook-backed capability
 
 1. Write down the webhook path, required auth, request JSON, and response JSON.
 2. If the path should become part of the shared action bus, document the `action` name and `args` shape in `references/payloads.md`.
-3. Keep the first version small and explicit.
-4. Only add the new endpoint to regular use after a successful `/webhook-test/` run.
+3. If the shipped workflow should support it, update `assets/openclaw-action.workflow.json` and rerun `scripts/validate-workflow.py`.
+4. Keep the first version small and explicit.
+5. Only add the new endpoint to regular use after a successful `/webhook-test/` run.
 
 ## Environment variables
 
@@ -94,4 +127,7 @@ This keeps the external surface small while letting n8n route internally.
 
 - `scripts/call-webhook.sh` — authenticated POST helper for direct local n8n webhooks
 - `scripts/call-action.sh` — wrapper for action-bus style calls against `openclaw-action`
+- `scripts/validate-workflow.py` — local structural validator for the shipped workflow asset
+- `assets/openclaw-action.workflow.json` — importable starter workflow for the action bus
+- `references/openclaw-action.md` — import, auth-binding, and testing guide
 - `references/payloads.md` — request/response contracts and naming conventions