Multi Agent Sync

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is coherent for visible multi-agent coordination, with the main things to notice being temporary watcher-style follow-ups and sharing worker-agent status in group topics.

This skill appears safe to use for transparent multi-agent task coordination. Before using it, make sure you are comfortable with periodic group updates, watcher-style follow-ups after the main chat returns, and any separate Codex skill used for coding subtasks.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI10: Rogue Agents
Low
What this means

The agent may continue polling and posting progress updates in the group thread after the initial dispatch.

Why it was flagged

The skill intentionally starts a background-style watcher for active multi-agent tasks. It is disclosed and scoped as temporary, but it means activity can continue after the main chat returns.

Skill content
Auto-start a temporary watcher job at kickoff (cron/timer) for this task.
Recommendation

Use it when you want ongoing group-visible coordination, and verify the watcher is removed once all worker agents are done or blocked.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Information from worker topics may be summarized into another group topic, so sensitive intermediate details could become more visible to participants.

Why it was flagged

The workflow reads worker-agent histories and republishes status or evidence into a summary topic. This is expected for the skill, but it crosses topic/session boundaries.

Skill content
Watcher tick action: poll agent session history (e.g., topic3/topic5), then immediately publish rollup to topic1.
Recommendation

Use trusted group topics and avoid placing secrets or private data in worker-agent progress messages.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Coding work may be delegated to another skill with its own capabilities, install requirements, or risks.

Why it was flagged

The skill directs coding subtasks to a separate named skill that is not part of the provided artifact set. That may be appropriate, but the separate skill's behavior and permissions are outside this review.

Skill content
For coding subtasks, explicitly state: use `openai-codex-operator` (Codex skill).
Recommendation

Only use this workflow with a trusted and reviewed `openai-codex-operator` installation, especially for repositories or files you care about.