Build a Software Development Team

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.3

Overview

This is a disclosed setup guide for creating an OpenClaw development team, with high-impact actions delegated to named admin, Asana, Git, and email skills.

Install this only if you intend to let it coordinate setup of multiple OpenClaw agents and project files. Review the delegated skills before use, especially openclaw-administrator, Asana, Git, and Email; keep real tokens in your secret manager, provide only env var names, and use the recommended recovery snapshots before and after setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger guidance is extremely broad and could cause the skill to activate for vague project-management requests without clear user intent for a high-impact setup operation. Because this skill writes configs, creates files, and clones repos, over-triggering raises the risk of unintended system modifications and delegated tool actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description does not prominently disclose that execution will create and modify agent workspaces, write multiple coordination/configuration files, and clone a repository locally. Poor disclosure can undermine informed consent and lead users to trigger a materially state-changing skill without realizing its system impact.

VirusTotal

63/63 vendors flagged this skill as clean.