agent-creator-skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:27 AM UTC
• Version: 1.0.6

Overview

This skill does what it says, but it creates persistent OpenClaw agents and stores generated operating instructions without a clear confirmation or review step.

Install only if you want a skill that can create durable peer agents in your OpenClaw setup. Before each run, require the agent to show the exact agent ID, display name, workspace path, and full identity prompt, then approve execution explicitly. Avoid using it with untrusted or copied prompt text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill's declared description understates its effective behavior: it directs execution of local shell or PowerShell scripts that may modify persistent OpenClaw configuration, but this side effect is not disclosed in the metadata. That mismatch is dangerous because users and automated governance may approve a seemingly harmless content-generation skill while it actually performs local state changes and agent registration, enabling unauthorized or surprising persistence.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill is explicitly designed to create and initialize persistent independent agents, including injecting an identity/system prompt through openclaw agent --message. Because this establishes durable behavior and state, malicious or manipulated user input could create long-lived agents with unsafe instructions, making the persistence aspect materially risky in this context.

Content

Scanner excerpt · README.md (reported line 6)May include surrounding context.

md

A lightweight skill for OpenClaw. Once installed, you can use natural language to command the Main Agent (Lobster) to automatically create, configure, and initialize other **independent Agents (not sub-agents)**.

## 💡 How It Works
1. **Command:** The Main Agent receives a natural language instruction (e.g., "Use agent-creator to create an agent expert in Python web scraping").
2. **Design:** The Main Agent consults the specifications in `SKILL.md`, automatically formats the agent ID (e.g., `python_spider_expert`), creates a friendly display name, and writes a detailed system prompt in the same language as the user's request unless another language is explicitly requested.
3. **Execution:** The Main Agent automatically calls the matching script for the current system, such as `bash create_agent.sh "python_spider_expert" "Python Web Scraping Expert" "You are a senior..."` on Linux/macOS/WSL/Git Bash, or `powershell -ExecutionPolicy Bypass -File create_agent.ps1 -AgentId "python_spider_expert" -DisplayName "Python Web Scraping Expert" -IdentityPrompt "You are a senior..."` on native Windows PowerShell.
4. **Initialization:** The selected script executes `openclaw agents add` and `openclaw agent --message`, instantly completing the environment setup and memory injection for the new Agent.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README describes the skill as being operable via general natural-language instructions and gives broad examples of how the main agent should interpret them. That makes trigger conditions ambiguous and can let unrelated conversation or adversarial phrasing cause the agent to generate IDs, prompts, and execution parameters for agent-creation scripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation instructions encourage users to invoke skill installation through a broad natural-language request to the main agent, which can blur the boundary between ordinary conversation and privileged skill-management actions. In agentic systems, vague conversational triggers increase the risk of accidental or prompt-injected activation of code retrieval and installation workflows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md

### Option 2: Manual Offline Installation
If you are developing or debugging locally:
1. Place this folder into the `~/.openclaw/workspace/skills/` directory. On native Windows, the equivalent path is usually `%USERPROFILE%\.openclaw\workspace\skills\`.
2. On Linux/macOS/WSL/Git Bash, enter the directory and ensure the shell script has execution permissions: `chmod +x create_agent.sh`. On native Windows PowerShell, use `create_agent.ps1`; no chmod step is required.
3. Restart OpenClaw or wait for the Main Agent to reload its skills.

## 💬 Usage Examples & Notes

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope or permissions, yet its documented behavior invokes local scripts that can read environment state and write files. In an agent framework, missing least-privilege boundaries increases the chance the skill can be invoked with broader capabilities than users or reviewers expect, especially because it creates and registers agents locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation rule is overly broad: any request to create a new agent, assistant, or proxy 'MUST' use this skill, without requiring a narrow intent match or confirmation. This can cause unintended invocation on ambiguous prompts, increasing the chance of unwanted local script execution and creation of persistent agent artifacts from casual or indirect user requests.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script takes untrusted persona text and injects it verbatim as persistent operating instructions for a newly created agent. This creates a prompt-injection-by-design pathway: any secrets, unsafe directives, or hostile behavior embedded in the supplied prompt will be stored and replayed as the agent’s long-term identity, increasing the chance of data disclosure or unsafe downstream actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.