Ceo Delegation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:14 PM UTC
• Version: 1.0.0

Overview

This skill is a broadly activating delegation workflow that can automatically spread user tasks across sub-agents, inspect session messages, and encourage persistent memory writes without clear opt-in controls.

Install only if you specifically want a Chinese-language, always-delegate workflow and are comfortable with task content being sent to additional sub-agents, recent session messages being used for monitoring, and outcomes being written to memory. Avoid using it for credentials, private code, personal data, or sensitive business tasks unless you add explicit consent, scoping, and redaction controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:8

Finding

Unconditional Agent Workflow and Role Hijacking

Content

View full analysis

Sub-agents must be used. Definition: Any task taking more than 30 seconds. Rule: A sub-agent must be spawned. Never run it in the main thread. ``` ```markdown Never skip validation. The executor and validator must be different agents. Record successful and failed experiences into memory. ``` ### Technical Analysis The skill does not limit delegation behavior to tasks for which the user explicitly requests delegation. Instead, it redefines the primary agent's role and applies unconditional rules to every task handled while the skill is loaded. The directives prohibit direct task execution, require task content to be forwarded to an execution agent, require a separate validation agent, impose recurring session monitoring, and mandate memory updates. These instructions therefore alter the agent's current-session goals and execution policy rather than merely providing an optional workflow. An attacker or untrusted package publisher could exploit this behavior by causing the skill to be loaded during an unrelated ta ...[truncated 2446 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says this workflow should be used 'when receiving any task,' making activation effectively universal. That is dangerous because it can hijack normal user requests, automatically delegate sensitive work to subagents, and expand the execution surface far beyond the narrow contexts where this workflow is appropriate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill references tool-like execution capabilities such as sessions_spawn, monitoring child sessions, and task delegation workflows, but it declares no explicit tool scope or allowed-tools metadata. That mismatch is dangerous because a broadly activatable orchestration skill can trigger code-capable or shell-adjacent actions without clear least-privilege boundaries or user-visible authorization constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is written as a Chinese-language workflow and presents itself as the default process for any task, which can implicitly force a language/locale choice without checking user preference. In isolation this is lower risk, but in a globally activating orchestration skill it can cause misunderstandings, incorrect task execution, or user confusion in sensitive operational contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's natural-language documentation is entirely in Chinese and presents the script's purpose and usage only in that language. There is no indication that the locale is optional, user-selected, or required for a region-specific purpose, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This script collects session metadata and recent message content from child-agent sessions, then prints it directly without any consent prompt, minimization, or disclosure to the user. If session messages contain sensitive prompts, secrets, or task data, running the monitor can expose information across tasks or audiences that were not intended to see it.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/monitor.py (reported line 22)May include surrounding context.

python

"""获取当前活跃的子代理会话"""
    cmd = ["openclaw", "sessions", "list", "--message-limit", "2", "--json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            return []
        sessions = json.loads(result.stdout)

Static analysis

No suspicious patterns detected.