Agent Factory (Walter)

• Analyzed: Apr 6, 2026, 5:16 PM
• Findings: 1
• Version: 2.1.1
• Hash: 0a245d02190c7f263c181cbfb24b4dfa41f4b3dc20afc264cddeb02d283af876
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill acts as an administrative tool to automate the creation of new agents, but it performs high-risk operations including modifying the core 'openclaw.json' configuration and handling sensitive Feishu 'appSecret' credentials. It is vulnerable to command injection in both the PowerShell and Bash scripts (SKILL.md) because it uses 'Invoke-Expression' and unsanitized variables to execute CLI commands. Additionally, it copies 'MEMORY.md' from the current workspace to the new one, which could lead to unintentional data leakage of sensitive conversation history between agents.