Back to skill
Skillv1.0.0
VirusTotal security
Colony · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 29, 2026, 3:46 AM
- Hash
- 69f3c7dfcef97cd98cc31be7b656a383eb53a25febb04afb8be2693ee88f2412
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: multi-agent-orchestration Version: 1.0.0 The skill is suspicious due to the inherent risks associated with an AI agent (`shell` agent) explicitly designed for 'system tasks' and 'deployments', combined with the potential for prompt injection. While there's no clear evidence of intentional malice, the `colony.mjs` and `colony-worker.mjs` scripts construct prompts for LLM agents using user-controlled inputs (task descriptions, process contexts) and internal state (agent memory, global context). If an attacker can manipulate these inputs or internal state, they could inject malicious instructions into the `shell` agent's prompt, potentially leading to arbitrary command execution via the `openclaw agent` tool. Additionally, the `notify` function in `colony.mjs` uses `execSync` to send messages via `openclaw message send`, which, despite basic escaping, represents an external communication channel that could be abused if the message content (derived from agent outputs or error messages) were maliciously crafted or if the `openclaw` CLI itself had injection vulnerabilities.
- External report
- View on VirusTotal