Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Claude Code Team(OpenClaw 适配版)

v2.0.0

自动识别平台,创建并启动百炼最优模型团队,自动分配角色任务,支持项目优化、修复及自定义团队管理。

0· 1·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description describe multi‑agent team orchestration and model mapping; the SKILL.md, teams.json and other docs consistently implement agent spawning (sessions_spawn), model selection, and local memory persistence — these are coherent with the purpose. Minor inconsistency: the package claims it '已应用' gateway/openclaw.json changes (system config) even though the skill is instruction‑only and has no install script; that claim is unexpected for a pure instruction skill.
!
Instruction Scope
Runtime instructions tell the agent to auto‑start teams on trigger words, spawn multiple agents, and persist memory under memory/teams and memory/agents — which is reasonable for a team orchestration skill. Concern: several files (GATEWAY_FIX.md, CONFIG.md) claim modifying openclaw.json and applying gateway configuration ('已应用'), implying changes to global/system configuration outside the skill directory. The SKILL.md also contains pre‑scan prompt‑injection signals (unicode control characters), which may indicate hidden or manipulative content in the instructions. Auto‑start triggers are broad (simply saying '团队' or '优化项目' will spawn multiple agents), which can lead to unexpected activity if you speak casually.
Install Mechanism
Instruction-only skill with no install spec and no code files executed by the scanner — lowest install risk. The repo metadata includes a suggested manual install (git clone) but the registry listing has no encrypted or remote downloads. No suspicious external download URLs detected in the provided files.
Credentials
Skill requests no environment variables or credentials in metadata — appropriate for a multi‑agent orchestrator that uses platform model context. However the skill expects to call models on multiple platforms (bailian, volcengine, openai) via sessions_spawn and assumes model platform credentials/configuration are available; it does not declare or ask for these credentials. Also, claims to change openclaw.json would require write access to agent/system config (not declared).
!
Persistence & Privilege
Skill persists memory under memory/teams/* and memory/agents/* — expected for team memory. Concern arises from explicit claims that gateway and openclaw.json were modified (GATEWAY_FIX.md shows a new global gateway config). A skill that writes or claims to have written system‑wide config files (outside its own skill directory) is a higher‑privilege action and should be confirmed before installation. always:false (normal), and autonomous invocation is default — combined with broad auto‑start triggers this can lead to unexpected background activity.
Scan Findings in Context
[unicode-control-chars] unexpected: Scanner detected unicode control characters in SKILL.md (prompt‑injection pattern). This is not expected for a straightforward multi‑agent orchestration skill and may hide or manipulate instruction content. Review the raw file for invisibles before trusting the skill.
What to consider before installing
What to check before installing: - Source trust: the skill's owner/repository is listed but source is marked unknown — prefer skills from trusted repositories and authors. Verify the GitHub repo and commit history before use. - System config changes: GATEWAY_FIX.md and other docs claim openclaw.json was modified. Because the skill is instruction‑only (no installer), it should not be able to change global config without explicit user action. Do NOT let it modify your openclaw.json or other global config unless you inspected the exact changes and consented. - Hidden content: the SKILL.md contains unicode control character findings. Inspect SKILL.md and other files in a text editor that can show invisibles; remove or reject the skill if there are suspicious hidden characters. - Test safely: run in a sandbox or test environment first. Use non‑sensitive projects and monitor network, file writes (especially memory/ and any openclaw.json changes), and spawned sessions. - Limit permissions: if your platform supports per‑skill sandboxes or file write restrictions, restrict this skill to its own skill directory and deny writes to global config paths. - Confirm model access: the skill assumes platform model access (bailian/volcengine/openai). Ensure only intended model backends are available and that the skill cannot use credentials for unrelated services. - Trigger behavior: note that simple phrases (e.g., '团队', '优化项目') will auto‑spawn multiple agents — consider disabling or narrowing auto triggers if unwanted. If you want, I can: (1) produce a short checklist of exact files/lines to inspect for hidden characters and openclaw.json diffs, or (2) suggest a safe test procedure (commands and checks) to run in a sandbox before enabling this skill in production.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ddqxs5gxsshhmbsdw0eatad844h12

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

🏢 Claude Code Team 模式(百炼模型版)

完全套用 Claude Code Team 模式,自动分配百炼最优模型


⚠️ 核心原则

  1. 你说团队名,我自动创建
  2. 你说任务,我自动分配
  3. 每个角色自动使用百炼最优模型
  4. 记忆自动持久化

🔄 百炼模型映射(核心)

角色百炼最优模型说明
产品经理bailian/qwen-max最强理解力,需求分析准确
设计师bailian/qwen-plus创意能力强,审美在线
程序员bailian/glm-5代码能力最强
架构师bailian/qwen-max全局视角,技术决策准
测试员bailian/glm-5细心,找 Bug 能力强
审查员bailian/glm-5代码审查、安全检查
运维师bailian/glm-5部署、性能优化
文档师bailian/glm-5文档编写规范

📋 标准团队配置

软件开发团队(8 人)

{
  "name": "软件开发团队",
  "members": [
    { "role": "产品经理", "model": "bailian/qwen-max", "responsibility": "需求分析、用户体验、功能优先级" },
    { "role": "设计师", "model": "bailian/qwen-plus", "responsibility": "视觉设计、动画效果、颜色方案" },
    { "role": "程序员", "model": "bailian/glm-5", "responsibility": "代码实现、技术评估、性能优化" },
    { "role": "测试员", "model": "bailian/glm-5", "responsibility": "测试用例、质量检查、Bug 追踪" },
    { "role": "审查员", "model": "bailian/glm-5", "responsibility": "代码审查、安全检查、规范检查" },
    { "role": "架构师", "model": "bailian/qwen-max", "responsibility": "系统架构、技术选型、最终决策" },
    { "role": "运维师", "model": "bailian/glm-5", "responsibility": "部署运维、监控告警、性能优化" },
    { "role": "文档师", "model": "bailian/glm-5", "responsibility": "文档编写、API 文档、用户手册" }
  ]
}

技术中台团队(4 人)

{
  "name": "技术中台团队",
  "members": [
    { "role": "技术总监", "model": "bailian/qwen-max", "responsibility": "统筹决策、技术方向" },
    { "role": "技术大拿", "model": "bailian/glm-5", "responsibility": "核心攻坚、技术难点" },
    { "role": "技术老人", "model": "bailian/qwen-coder-plus", "responsibility": "资深开发、带新人" },
    { "role": "技术新秀", "model": "bailian/qwen-coder-next", "responsibility": "执行任务、学习成长" }
  ]
}

搞钱特战队(10 人)

{
  "name": "搞钱特战队",
  "members": [
    { "role": "市场猎手", "model": "bailian/qwen-max", "responsibility": "发现赚钱机会" },
    { "role": "商业顾问", "model": "bailian/qwen-max", "responsibility": "评估可行性" },
    { "role": "技术专家", "model": "bailian/glm-5", "responsibility": "技术方案" },
    { "role": "流量操盘手", "model": "bailian/qwen-plus", "responsibility": "获客推广" },
    { "role": "内容专家", "model": "bailian/qwen-plus", "responsibility": "内容生产" },
    { "role": "财务管家", "model": "bailian/glm-5", "responsibility": "资金管理" },
    { "role": "风险控制官", "model": "bailian/qwen-max", "responsibility": "风险防控" },
    { "role": "美术设计师", "model": "bailian/qwen-plus", "responsibility": "视觉设计" },
    { "role": "质量把控员", "model": "bailian/glm-5", "responsibility": "质量检查" },
    { "role": "创意专家", "model": "bailian/qwen-plus", "responsibility": "创意策划" }
  ]
}

🚀 工作流程

方式 1:标准团队任务

用户说:"软件开发团队,优化抖音 3D 算命项目"
    ↓
自动执行:
1. 识别团队名 → 软件开发团队
2. 加载团队配置 → 8 个角色
3. 为每个角色分配百炼模型
4. 启动 8 个 Agent(sessions_spawn)
5. 等待所有结果
6. 汇总汇报给董事长

方式 2:自定义团队

用户说:"创建一个 AI 研究团队,包括 AI 专家、数据科学家、算法工程师"
    ↓
自动执行:
1. 创建新团队配置
2. 为每个角色分配百炼最优模型
3. 启动团队
4. 分配任务

🧠 记忆系统

团队记忆

位置: memory/teams/{团队名}/MEMORY.md

自动记录:

  • 任务历史
  • 决策记录
  • 经验教训

Agent 记忆

位置: memory/agents/{角色名}/MEMORY.md

自动记录:

  • 个人经验
  • 任务完成记录
  • 技能成长

⚡ 性能优化

Gateway 超时解决

问题解决方案
超时设置120 秒
连接泄漏任务完成后自动关闭
并发限制动态调整(默认 10)
内存压力定期清理旧连接

模型成本优化

策略说明
简单任务用 glm-5成本低、速度快
复杂任务用 qwen-max能力强、准确
创意任务用 qwen-plus平衡成本与创意

📋 使用示例

示例 1:软件开发团队

用户:软件开发团队,优化抖音 3D 算命项目

贾维斯自动启动:
- 产品经理 (bailian/qwen-max) → 需求分析
- 设计师 (bailian/qwen-plus) → 视觉设计
- 程序员 (bailian/glm-5) → 代码实现
- 架构师 (bailian/qwen-max) → 技术决策

等待完成后汇总结果...

示例 2:技术中台团队

用户:技术中台团队,解决 Gateway 超时问题

贾维斯自动启动:
- 技术总监 (bailian/qwen-max) → 统筹决策
- 技术大拿 (bailian/glm-5) → 核心攻坚
- 技术老人 (bailian/qwen-coder-plus) → 经验建议
- 技术新秀 (bailian/qwen-coder-next) → 执行测试

等待完成后汇总结果...

示例 3:自定义团队

用户:创建一个 AI 研究团队,研究大模型应用

贾维斯自动:
1. 创建团队配置
2. 分配角色:AI 专家、数据科学家、算法工程师
3. 为每个角色分配百炼最优模型
4. 启动团队
5. 分配任务

🎯 验收标准

功能验收标准
团队创建说团队名,自动创建配置
任务分配说任务,自动分配给所有成员
模型分配每个角色自动使用百炼最优模型
记忆持久团队记忆自动保存到 memory/teams/
进度追踪任务状态自动更新
Gateway 稳定超时 120 秒 + 自动清理连接

⚠️ 注意事项

  1. Gateway 超时 - 复杂任务可能超过 120 秒,需手动延长
  2. 记忆清理 - 定期清理旧记忆(建议每周)
  3. 模型成本 - 多 Agent 同时运行,注意 API 成本
  4. 并发限制 - 默认 10 个并发,大团队需调整

版本:1.0.0
状态:✅ 激活
模型:百炼大模型
创建时间:2026-04-03

Files

10 total
Select a file
Select a file to preview.

Comments

Loading comments…