teamclaw_test

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.0

Overview

TeamClaw appears to be a real multi-agent service, but it gives agents and exposed web routes high-impact authority with weak scoping and some secret-handling risks.

Install only if you are prepared to run a multi-service agent platform with code execution, file mutation, bot integrations, and optional public exposure. Use it on a dedicated machine or container, keep it bound to localhost unless hardened, avoid configuring OpenClaw API keys until the unauthenticated disclosure route is fixed, pin and verify downloaded binaries, and disable command/Python tools unless you explicitly need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (61)

Tainted flow: 'LOCAL_OPENAI_COMPLETIONS_URL' from os.getenv (line 28, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

# 直接透传请求体和 Authorization header 到后端
    auth_header = request.headers.get("Authorization", "")
    try:
        r = requests.post(
            LOCAL_OPENAI_COMPLETIONS_URL,
            json=request.get_json(silent=True),
            headers={

• Confidence: 97% confidence
• Finding: The app exposes a generic OpenAI-compatible proxy at /v1/chat/completions and forwards any caller-supplied Authorization header and request body to the internal agent service. This turns the frontend into a programmatic relay to privileged local services, expanding access beyond the declared UI role and potentially enabling abuse of backend capabilities, credential replay, and data exfiltration through the proxy.

Tainted flow: 'agent_url' from os.getenv (line 608, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"temperature": 0.3,
        }

        resp = requests.post(agent_url, json=payload, headers=headers, timeout=60)

        if resp.status_code != 200:
            return jsonify({

• Confidence: 96% confidence
• Finding: The destination URL for the credential-bearing request is derived from environment-controlled configuration (`MAIN_AGENT_URL` / `.env`) and then used in `requests.post` along with user-supplied username/password in the Authorization header. If that URL is changed to a non-local or attacker-controlled endpoint, the application will exfiltrate credentials and full prompt contents to that endpoint.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The README explicitly advertises an autonomously managed 'evolution branch' used for core logic optimization, self-healing, and adding new system-level skills. In an agent platform that already includes file, command, scheduling, and public exposure capabilities, normalizing self-modification materially increases the risk of unreviewed code changes, persistence, and privilege expansion beyond the stated orchestration purpose.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The README advertises an autonomous self-evolution branch used for core logic changes and adding new system-level skills. In an agent skill whose documented scope is orchestration, UI, bots, and tunneling, self-modifying behavior materially expands capability and can bypass normal review, making the system harder to constrain or audit.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documentation states that OASIS endpoints can be used directly without Authorization and rely only on a caller-supplied user_id for isolation. That is not authentication; any local or proxied caller who can reach the service may impersonate another user_id, read or modify workflows, topics, experts, and sessions, or trigger actions on behalf of others.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The metadata advertises defined authentication methods, but the OASIS API section later says those endpoints need no Authorization header. This inconsistency is dangerous because it can mislead reviewers into believing the documented auth applies universally when a major subsystem is apparently unauthenticated.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The bot constructs an Authorization credential from INTERNAL_TOKEN plus a chosen username and platform string, effectively allowing the QQ bot to impersonate an internal system user when calling the backend. If the bot is compromised, misconfigured, or reachable by untrusted QQ users, their prompts and attachments are processed under privileged internal identity, creating an authentication-boundary bypass and potential privilege escalation path.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The bot constructs a bearer token as INTERNAL_TOKEN:username:TG and the code comments explicitly describe this as administrator-level authentication performed on behalf of a mapped Telegram user. That creates a powerful trust bridge from Telegram identity to internal agent authority; if the whitelist is misconfigured, a Telegram account is taken over, or username-based matching is abused, an external chat message can trigger privileged actions as an internal user.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The /sessions/oasis endpoint lets callers enumerate sessions from a local checkpoint database for any supplied user_id, and even when no user_id is supplied it returns all matching sessions. That exposes cross-user metadata from unrelated agent activity and can leak sensitive operational information, violating tenant isolation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The /sessions/openclaw endpoint returns OPENCLAW_API_KEY and backend URL information directly to any caller. This is direct secret disclosure that can enable unauthorized access to the backend service, abuse of paid APIs, and lateral movement into adjacent systems.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The launcher expands its capabilities beyond orchestration by downloading and running an external Bark push-notification server binary. That increased execution scope matters because it introduces third-party code execution and network-facing functionality not clearly implied by the stated launcher purpose, enlarging the attack surface.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code automatically downloads a third-party executable from the internet and later executes it locally, but performs no signature verification, checksum validation, or release pinning. If the download source, release channel, or transport path is compromised, the launcher could run attacker-controlled code on the host.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This script directly creates or updates application user accounts by writing credential data into a local users.json file, and it can be invoked non-interactively by an external agent. In the context of a multi-agent orchestration skill, that increases risk because any component able to run this script can silently provision or reset access without authorization checks, audit logging, or operator confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The agent injects absolute per-user manifest and skill directory paths into the model prompt and explicitly instructs the model to use file-management tools to read corresponding skill files. In a system that also exposes read/list file tools, this increases the likelihood of prompt-driven local file inspection and disclosure of sensitive data beyond the user's immediate request.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code auto-enables powerful tools such as run_command and run_python_code and also starts a commander MCP service, giving the model shell/code-execution capability. In an LLM-agent context, this is highly dangerous because prompt injection, malicious skill content, or model misuse can translate directly into host command execution, data exfiltration, or system compromise.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This file exposes a broadly usable OpenAI-style API proxy instead of a narrowly scoped web UI backend. That materially increases attack surface because external callers can script against internal agent functions through the frontend service rather than being constrained to intended browser workflows.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module advertises a 'secure sandboxed' executor with a strict safe-command whitelist, but the implementation permits shell execution with broad capabilities including python, node, git, npm, curl/wget, and file-writing commands. This mismatch is dangerous because downstream agents or reviewers may trust the safety claims and expose the tool in contexts where arbitrary code execution, data exfiltration, or filesystem modification becomes possible.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The run_command docstring claims only safe read-only/text-processing commands are allowed, but the whitelist includes commands that can write files or execute arbitrary code, such as python, node, npm, npx, git, powershell, curl, and wget. In an agent setting, this kind of overstatement can cause unsafe delegation of powerful execution primitives under the false assumption that they are read-only.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file exposes two high-risk tools: arbitrary shell command execution via create_subprocess_shell and arbitrary Python code execution via create_subprocess_exec on user-provided code. Given the skill's stated purpose around orchestration/UI/social bot integration, these capabilities are not narrowly justified and materially increase the chance of host compromise, local file access, package installation, persistence, or data exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module exposes a `send_to_group` capability that is not reflected in the stated skill scope, increasing the effective privilege and communication surface available to the agent. Hidden or undocumented messaging functions are dangerous because they can be used to disseminate data to multiple recipients without operators realizing the capability exists.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: `call_llm_api` accepts arbitrary caller-supplied URLs and bearer tokens and performs outbound POST requests with user content, effectively giving the agent a generic exfiltration and SSRF-like network primitive. In an agent-orchestration context, this is more dangerous than a normal API wrapper because prompts, secrets, and internal data can be forwarded to attacker-controlled endpoints under the guise of an LLM call.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file is presented as a standalone visual editor/exporter, but this route additionally forwards prompts and user credentials to a backend agent service. That hidden expansion of scope increases attack surface and can surprise users into transmitting sensitive data to another component they did not intend to trust.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The comment claims credentials are 'not stored in backend,' but the backend does receive them and uses them to authenticate a downstream request. Even if not persisted, misleading security claims can cause unsafe operator assumptions and reduce scrutiny around sensitive-data handling.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This UI explicitly collects a username and password from DOM fields and attaches them to the request body sent to /api/agent-generate-yaml. In a canvas/YAML-generation frontend, collecting backend credentials in the browser materially expands the trust boundary and can expose secrets to logging, interception, browser extensions, or unintended downstream processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation promotes one-command public internet exposure via Cloudflare Tunnel with 'zero configuration' and 'no account needed' but does not pair this with explicit warnings about exposing admin surfaces, chat history, user files, bot integrations, and internal services to the public internet. This omission is dangerous because users may enable remote access without understanding authentication, rate limiting, data leakage, and attack-surface implications.

VirusTotal

58/58 vendors flagged this skill as clean.