AOI Squad Orchestrator (Lite)

• Risk level: Low
• Analyzed: May 1, 2026, 5:42 AM
• Findings: 1
• Version: 0.1.1

Overview

This skill appears to be a small local CLI for generating preset team reports, with only a low-risk local file used to remember renamed team members.

This looks safe to install for its stated purpose. Be aware that renamed team member aliases are saved locally, so avoid putting secrets or sensitive personal data in those names.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI06: Memory and Context Poisoning

Info

What this means

Any renamed team member names can persist locally and appear in future generated reports.

Why it was flagged

The skill stores user-defined team names in a persistent local JSON file and reuses them in later outputs.

Skill content

return path.join(os.homedir(), ".openclaw", "aoi", "squad_names.json"); ... fs.writeFileSync(fp, JSON.stringify(db, null, 2) + "\n", "utf8");

Recommendation

Use non-sensitive aliases and delete or edit ~/.openclaw/aoi/squad_names.json if you want to reset the stored names.