Build a Software Development Team

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it needs review because it can make broad, persistent changes to agents, install unpinned dependency skills, and delegate sensitive repository actions.

Install only after reviewing the side effects: it will configure agents, write persistent coordination files, schedule heartbeats, install dependency skills, clone repositories, and enable PM chat completions. Pin every dependency skill to a trusted publisher/version, validate project names and repo SSH URLs, keep token values in a secret manager, and require an explicit human confirmation with PR number and branch before any merge to main.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:287
• Finding: Unpinned Third-Party Skills Selected Through a Mutable Popularity Ranking## Vulnerability Details **File Location**: `SKILL.md:287-305` **Vulnerability Type**: Untrusted and unpinned dependency installation **Risk Level**: High **Vulnerable Code Snippet**: ```text ### Dependency Skills (Required — Install First) DEPENDENCY SKILLS — install these first on each agent: All agents: - Asana skill (for Asana task management) Agents that touch code (engineer, dev-fe, dev-be, qa, n8n_engineer): - Git skill (for repository operations) PM agent only: - Email skill (for Dev Manager completion alerts) Search ClawHub for the best-rated version of each if not already installed. ### EncryptShawn Workflow Skills (All Agents) - openclaw-administrator - openclaw-recovery-manager - approved-self-improver ``` ### Technical Analysis The setup procedure instructs the Agent to search ClawHub and install the “best-rated” version of several dependency Skills. It does not pin an exact publisher, package slug, version, or integrity digest for the Asana, Git, and email dependencies. Popularity and rating are mutable discovery signals rather than security boundaries. Consequently, the effective dependency selected during installation can differ from the dependency that was previously reviewed. An attacker could exploit ranking manipulation, publisher impersonation, typosquatting, or compromise of a currently popular package. Installing the selected dependencies on multiple Agents amplifies the exposure. The unconditional inclusion of `approved-self-improver` further increases the potential consequences because self-modification capabilities are not required merely to provision a development team. ### Attack Path 1. An attacker publishes or compromises a ClawHub Skill matching a requested dependency category, such as an Asana, Git, or email Skill. 2. The attacker manipulates ratings or otherwise causes that package to appear as the “best-rated” result. 3. During team setup, the Agent follows ...[truncated 1221 chars]
• Remediation: ## Remediation Suggestions 1. Replace popularity-based selection with an explicit allowlist containing the trusted publisher, exact package slug, and reviewed version for every dependency. 2. Pin a cryptographic integrity digest or signed release identity where the platform supports it. 3. Require operator confirmation before installing any dependency that is not already on the allowlist. 4. Perform a static review of each dependency's instructions, scripts, requested permissions, network behavior, and credential access before installation. 5. Record the resolved owner, version, and digest in the project configuration to support reproducible setup and future audits. 6. Apply least privilege per role. For example, do not install email functionality outside the PM Agent, and limit Git permissions to only the required repositories and operations. 7. Remove `approved-self-improver` from the default installation set unless the operator explicitly requests it and accepts its additional trust implications. 8. Reject similarly named, newly published, unsigned, or ownership-changed packages until manually reviewed.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:616
• Finding: Shell Command Injection Through Unquoted User-Controlled Setup Values## Vulnerability Details **File Location**: `SKILL.md:616-619` **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Code Snippet**: ```bash cd ~/.openclaw/projects/[project_name]/workspace git clone [repo_ssh_url] repo mkdir -p mockups ``` ### Technical Analysis The Skill gathers `project_name` and repository SSH URLs from the user during setup and later interpolates those values into shell commands. The command template does not specify input validation, shell-safe quoting, argument-array execution, or an end-of-options delimiter. If placeholders are replaced verbatim and the resulting text is executed through a shell, command separators, command substitutions, redirections, whitespace, or other shell metacharacters in a crafted project name or repository value can alter the intended command. A malicious project name can affect the `cd` command, while a malicious repository string can affect the `git clone` invocation. Quoting alone is not a complete defense if validation and process invocation remain unsafe. Repository values must be parsed as Git SSH URLs, project identifiers must be restricted to a safe character set, and Git should be invoked through a process API that passes each argument separately rather than constructing a shell command string. ### Attack Path 1. An attacker supplies a crafted project name or repository SSH URL during the information-gathering step. 2. The setup workflow substitutes the supplied value into the documented command template. 3. The setup Agent executes the generated command through a shell. 4. The shell interprets attacker-provided metacharacters or substitutions as additional syntax rather than as literal data. 5. The injected command executes with the operating-system privileges and environment of the setup Agent. 6. The attacker may then read or modify accessible files, alter the OpenClaw project configuration, tamper with cloned source code, o ...[truncated 898 chars]
• Remediation: ## Remediation Suggestions 1. Validate `project_name` before using it in any path. Use a strict allowlist such as `^[A-Za-z0-9._-]+$`, reject `.` and `..`, and enforce a reasonable maximum length. 2. Resolve the final project directory and verify that its canonical path remains beneath the intended `~/.openclaw/projects/` root. 3. Parse repository inputs and accept only approved SSH Git URL forms, such as `[e-mail]:organization/repository.git`, with an optional allowlist of permitted hosts and organizations. 4. Invoke Git with a process execution API and a fixed argument array equivalent to `["git", "clone", validatedRepoUrl, "repo"]`. Do not build a shell command through string concatenation. 5. Create directories through a filesystem API. If a shell is unavoidable, quote every expanded path safely and use end-of-options delimiters where supported. 6. Reject shell metacharacters, control characters, newlines, leading option markers, command substitutions, and unexpected whitespace in all values used by commands. 7. Run repository cloning and project initialization with a dedicated least-privileged account and a minimal environment. 8. Add negative tests covering semicolons, pipes, redirections, backticks, `$()` substitutions, embedded newlines, path traversal sequences, and option-injection inputs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

This skill collects only the *names* of env vars (e.g., `TA_ASANA_PAT`) — never their values. Those env var names are passed to the dependency skills so they know which credential to pull from the agent runtime environment.

Credentials must be stored in your secret management system (Kubernetes ConfigMap/Secret, .env file, or equivalent) before setup begins.

---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```
Credential check — confirm in your secret management system:

- [ASANA_PAT_ENV_VAR_NAME] — Asana personal access token
- [GITHUB_PAT_ENV_VAR_NAME] — GitHub personal access token
- [DEV_MANAGER_EMAIL_ENV_VAR_NAME] — Dev Manager email address

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```
Credential check — confirm in your secret management system:

- [ASANA_PAT_ENV_VAR_NAME] — Asana personal access token
- [GITHUB_PAT_ENV_VAR_NAME] — GitHub personal access token
- [DEV_MANAGER_EMAIL_ENV_VAR_NAME] — Dev Manager email address

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger criteria are very broad and include ambiguous phrases that could cause the skill to activate in contexts where the user did not intend full administrative setup. Because this skill performs agent configuration, file creation, and repo wiring, over-triggering can lead to unintended system modifications or premature collection of infrastructure details.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill carries out substantial state-changing operations such as writing workspace files, changing agent configuration, enabling chat completions, and cloning repositories, but it does not present a consolidated upfront warning at the beginning. Users may not realize the scope of modifications until deep into execution, increasing the risk of unsafe or accidental changes.

Session Persistence

Medium

• Category: Rogue Agent

Content

---

## Step 6 — Write Agent Workspace Files

Using the openclaw-administrator skill, write the following files for each agent.

• Confidence: 86% confidence
• Finding: The skill instructs persistent writing of per-agent workspace files including HEARTBEAT.md, USER.md, TOOLS.md, and AGENTS.md. While these are framed as operational state, persistent cross-session files can become a durable control surface that influences future agent behavior, expanding the blast radius of mistakes or malicious edits and creating a persistence mechanism within the agent environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly instructs the QA agent to merge a pull request to main on operator instruction, giving an AI agent direct authority over a potentially destructive repository action. Even though a human review step exists, the document does not require an explicit safety confirmation checklist, branch protection verification, or a narrowly scoped non-destructive merge mechanism, so a mistaken, spoofed, or context-confused instruction could result in unintended code being merged to production.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The security model section states that the skill does not 'read, store, request, or transmit any credentials or secret values,' yet it immediately says the skill collects env-var names and Step 1 asks the user to provide those names. Env-var names are not secret values, so this is not a dangerous credential leak, but the documentation's 'does not request' wording contradicts the actual intake behavior described in the file.

Static analysis

No suspicious patterns detected.