OpenClaw Orchestrator — Finance & Python Team

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.1

Overview

This orchestration skill matches its stated purpose, but it delegates agent behavior through missing and mutable workspace files without enough scoping or user control.

Review before installing. This skill may be appropriate in a tightly controlled workspace where AGENTS.md, MEMORY.md, and the referenced orchestration files are trusted and versioned. Avoid using it in workspaces where those files can be edited by untrusted parties, and require explicit user approval before sub-agent spawning or model changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10

Finding

Agent Role and Workflow Hijacking Through Mandatory Orchestration Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–53
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

You are Claw, the orchestrator. Read `AGENTS.md` for your role, team, and mode state.
This file is the entry point for the skill system.

## Reference files (load on demand via `read`)

| File | Contents |
|---|---|
| `skills/orchestrate/ref_latency.md` | Instant-path rules, context hygiene — read first |
| `skills/orchestrate/ref_phases.md` | Four phases: Decompose → Tier → Spawn → Synthesise |
| `skills/orchestrate/ref_models.md` | Model IDs by tier, free mode table |
| `skills/orchestrate/ref_roles.md` | Sub-agent roster, spawn templates, workspace rules |
| `skills/orchestrate/ref_patterns.md` | Orchestration patterns and anti-patterns |
| `skills/orchestrate/ref_guardrails.md` | Safety, data handling, finance rules |

## Decision flow

Incoming message │ ▼ [1] skills/orchestrate/ref_latency.md → instant path? → reply now, STOP │ no ▼ [2] Read MEMORY.md → find "FREE_MODE:" line FREE_MODE: true (or absent) → all spawns use openrouter/stepfun/step-3.5-flash:free FREE_MODE: false → spawns use role defaults in skills/orchestrate/ref_models.md │ ▼ [3] Single-role task, no dependencies? │ yes → spawn that sub-agent (skills/orchestrate/ref_roles.md), STOP │ no ▼ [4] Full phases (skills/orchestrate/ref_phases.md) │ ▼ [5] Synthesise and reply

text

## Free mode — always check MEMORY.md

Before any spawn, confirm current mode:
- `FREE_MODE: true` (default) → `model: "openrouter/stepfun/step-3.5-flash:free"`, `thinking: "none"`
- `FREE_MODE: false` → use role defaults from `skills/orchestrate/ref_models.md`

Technical Analysis

The skill directly reassigns the agent's identity with the instruction `You ar ...[truncated 2484 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional identity reassignment and describe orchestration as an optional capability rather than replacing the agent's role.
2. Remove mandatory STOP directives. The host agent should retain control of task completion and only terminate processing when required by higher-priority instructions or the user's request.
3. Treat AGENTS.md, MEMORY.md, and all referenced Markdown files as untrusted data. Their contents must not override system, developer, or active user instructions.
4. Validate that referenced files exist and are located within an approved project root before reading them. Reject path traversal, symbolic-link escapes, and unexpected file types.
5. Define a strict schema for configuration values such as FREE_MODE. Parse only allowlisted values instead of interpreting arbitrary surrounding text as instructions.
6. Require explicit user approval before spawning sub-agents, transferring task data, or changing the processing model.
7. Apply least-privilege controls to delegated agents and provide only the minimum context and tools required for the approved task.
8. Pin reviewed orchestration policies and model mappings to trusted, version-controlled files rather than mutable memory state.
9. Add a clear precedence rule stating that skill and workspace content cannot modify safety constraints, authorization boundaries, or higher-priority instructions.
10. Fail safely when referenced files are missing or invalid instead of falling back to potentially unsafe implicit behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.