OpenClaw Agent Orchestrator

• Outcome: Pass
• Latest audit: Aug 30, 2026 · 5:47 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed multi-agent orchestration helper; its cross-agent messaging and optional config changes are aligned with that purpose and require user direction.

Install this only if you want an agent to coordinate other OpenClaw agents. Before approving any config.patch, verify exactly which agents are being added to visibility or allowlists, because that change may persist and allow future cross-agent messaging.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill claims to orchestrate agents, dispatch tasks, inspect session state, and enforce authorization rules, but the analyzed content does not implement those controls or behaviors. This is dangerous because users may rely on nonexistent coordination and access-control checks, creating a false sense of safety that can lead to misdelegation, incomplete review, or insecure operational decisions in a multi-agent environment.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The README frames the skill primarily as a dispatch/tracking orchestrator, but it also states that it can automatically modify openclaw.json via config.patch after user approval. That capability changes the trust boundary from passive orchestration to configuration mutation, which can expand agent communication permissions and alter security posture if users underestimate what the skill can do.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: Saying openclaw.json is the 'sole source of truth' while also documenting that the skill can modify that file creates misleading documentation about whether the skill is read-only or state-changing. In a security-sensitive orchestration tool, that ambiguity can cause users to grant trust they would not give if mutation capabilities were clearly emphasized.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes broad everyday terms such as '分析 / 看看 / review-like phrasing' that can match ordinary user requests and cause the orchestrator to activate when the user did not explicitly want multi-agent delegation. In this skill's context, unintended invocation is more dangerous because activation can lead to cross-agent task dispatch, result aggregation, and possible shared-config checks or edits, expanding the blast radius beyond a simple false activation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The design permits modifying openclaw.json via config.patch to satisfy agent communication requirements, but it does not clearly require a prominent user-facing warning that this is a shared, system-impacting configuration change. In this skill's context, that omission is risky because changing bidirectional allowlists can broaden inter-agent communication pathways and persist beyond the current task, potentially enabling unintended future delegation or trust boundary expansion.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description defines broad natural-language triggers such as 'orchestrate/parallel/delegate' and similar Chinese phrases, plus fuzzy activation for 'big tasks,' which can cause the skill to activate in situations the user did not clearly intend. Because this skill can dispatch work to other agents and aggregate their outputs, overbroad activation increases the chance of unintended multi-agent delegation, unnecessary data sharing, and execution of privileged cross-agent workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.