multi-agents-orchestration

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:00 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent OpenClaw multi-agent setup guide, but its examples grant broad agent-delegation authority that users should review before applying.

Install only if you are comfortable manually changing persistent OpenClaw agent configuration. Before applying the examples, replace wildcard agent delegation with explicit allowlists for each role, keep Discord bot tokens scoped and private, and enable only the Discord/bot-bot features you actually need.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:100

Finding

Wildcard Sub-Agent Authorization Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 100 and 273
Vulnerability Type: Unrestricted sub-Agent delegation
Risk Level: Medium

Vulnerable Code

The same insecure configuration is recommended in two examples:

json

"subagents": { "allowAgents": ["*"] }

Technical Analysis

The wildcard in allowAgents authorizes the configured specialist Agent to invoke every registered Agent rather than only those required for its role. This violates the principle of least privilege.

The documented architecture assigns orchestration responsibilities to the main Agent while specialist Agents receive bounded tasks. Consequently, specialist Agents generally do not require unrestricted delegation rights. If a specialist processes attacker-controlled content, such as a Discord message or delegated task containing prompt-injection instructions, the wildcard permission may allow that input to cross role boundaries and trigger Agents with broader tools, data access, or operational authority.

The finding concerns the recommended configuration itself. Whether exploitation succeeds in a deployed environment depends on the registered Agents, their tools, and the runtime's authorization controls.

Attack Path

1. An administrator deploys a specialist Agent using the documented allowAgents: ["*"] configuration.
2. An attacker supplies malicious instructions through an input accepted by that specialist, such as Discord content or task data.
3. The specialist follows the injected instructions and attempts to spawn another registered Agent outside its intended collaboration boundary.
4. The wildcard allowlist permits the cross-role invocation.
5. The newly invoked Agent may use its own tools or access rights to perform actions unavailable to the original specialist.

Impact Assessment

A compromised or prompt-injected specialist could invoke any registered Agent permitted by the surrounding runtime. This may result in:

• Unauthorized cro ...[truncated 490 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the wildcard with an explicit allowlist containing only the Agents that the role must legitimately invoke:

json

"subagents": {
  "allowAgents": ["compliance-reviewer"]
}

• Remove the subagents authorization entirely from specialist Agents that do not need to delegate work.
• Reserve broad orchestration permissions for the trusted main Agent, and still prefer an explicit allowlist where practical.
• Define separate allowlists for each role according to its documented responsibilities and collaboration boundaries.
• Ensure that authorization is enforced by the runtime rather than relying only on prompt instructions in role files.
• Treat Discord messages and delegated task content as untrusted input and add confirmation controls before sensitive cross-Agent operations.
• Log and monitor Agent-spawn requests, including source Agent, target Agent, task origin, and authorization result.
• Add configuration tests that reject wildcard delegation for non-orchestrator Agents.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill is written as Chinese-only operational guidance and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

Step 1：创建 Agent Workspace

bash

mkdir -p ~/.openclaw/workspace-{agent-id}

SOUL.md 四段式模板：

Static analysis

No suspicious patterns detected.