ClawHub
Back to skill

Security audit

OpenClaw Agent Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent orchestration helper; it can share tasks across authorized agents, but the behavior is coherent with its stated purpose.

Install only if you want OpenClaw agents to delegate work to each other. Before using it, review your agentToAgent allowlist and sessions visibility, because delegated prompts and results will be visible to the selected agents. Approve config.patch changes only when you understand which agents are being authorized.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This second description-behavior mismatch is security-relevant because the skill claims to read openclaw.json, enforce bidirectional allowlists, and apply trigger gating, yet those safeguards are not evidenced in the analyzed file. Security controls that exist only as documentation can cause operators to assume delegation is constrained when it may not be, increasing the chance of policy bypass or unintended agent coordination.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This second description-behavior mismatch is security-relevant because the skill claims to read openclaw.json, enforce bidirectional allowlists, and apply trigger gating, yet those safeguards are not evidenced in the analyzed file. Security controls that exist only as documentation can cause operators to assume delegation is constrained when it may not be, increasing the chance of policy bypass or unintended agent coordination.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme/hero.svg (reported line 7)May include surrounding context.

text
<rect width="1200" height="360" rx="20" fill="#0d1117"/>

  <!-- left: title block -->
  <g id="title-block" transform="translate(56 40)">
    <text x="0" y="44" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="20" letter-spacing="4" fill="#8b949e">OPENCLAW · AGENT SKILL</text>

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The language selector presents Chinese as the default/current option while English is only available via a separate link. This indicates a locale preference imposed by the skill documentation rather than offering an explicit language choice or neutral default.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill describes capabilities that require reading configuration and inspecting environment/runtime state, but it does not declare corresponding tool scope or permissions. This creates a transparency and least-privilege problem: the platform or user may not be able to accurately constrain or review what the skill needs, increasing the risk of overbroad access or unexpected file reads.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description switches into Chinese-only instructional content for trigger behavior and usage scenarios, but does not indicate that language is selectable or optional. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains the skill's design guidance entirely in Chinese, including operational behavior, triggers, and release instructions. Under the policy, forcing a specific language without user opt-in or a documented, justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description includes broad trigger cues such as orchestration, delegation, parallel work, and multilingual phrasing that can encourage activation from loosely related user requests. In an agent that can dispatch work to other agents and aggregate outputs, ambiguous invocation increases the chance of unintended multi-agent actions, unnecessary data propagation, or user confusion about whether delegation was explicitly requested.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire skill documentation is written only in Chinese and includes a directive that orchestration skills must use this mechanism, but it does not offer any language choice or indicate that the Chinese-only presentation is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states that after completion, the system may forward the original request and replies to a target channel, but it does not require user notice, consent, or redaction. In a multi-agent orchestration skill, this creates a real confidentiality risk because prompts, intermediate results, or sensitive user data can be propagated across sessions/channels beyond the user’s expected audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire skill file defines the task-dispatch template exclusively in Chinese and provides no indication that language can be selected based on user preference. This creates a natural-language locale policy concern because it effectively imposes a specific language on downstream agent interactions without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This file's descriptive content is predominantly Chinese, including status, positioning, workflow, and rules, with no indication in the file that users may choose another language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file is explicitly the English README and presents language selection with English fixed as the active variant. Under the stated policy, forcing a language/locale without user opt-in is a natural-language policy issue unless the user is offered a choice within the experience itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
63% confidence
Finding

The manifest description mixes English with Chinese and presents the skill identity and behavior in Chinese without stating that language selection is optional or user-driven. Because policy requires avoiding forced language or locale constraints unless documented or opt-in, this can be read as a language preference imposed by the skill metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring, usage notes, and output descriptions are written entirely in Chinese, while the file does not indicate that language is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file’s user-facing documentation and help strings are written in Chinese, and the script emits status labels and descriptions based on that language choice without offering an alternative locale. This is a natural-language policy concern because it hardcodes a specific language rather than giving the user a language/locale option or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.