Security audit

Agent Council

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not malicious, but it deserves Review because it can persistently create agents, change OpenClaw gateway and Discord state, and overwrite workspace files without strong confirmation or rollback controls.

Install only if you intend to let this skill modify your OpenClaw gateway configuration and Discord channels. Use a fresh, dedicated workspace path, review generated config before applying where possible, avoid health or other sensitive personal data unless you have proper privacy controls, and document how to remove created agents, bindings, channels, and cron jobs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill clearly describes operations that read environment variables, modify local files, patch gateway configuration, restart services, and interact with Discord over the network, yet it declares no explicit permissions or safety boundary. This creates hidden capability risk because an invoking agent or user may not realize the skill can make persistent system and external-service changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly promotes a 'Health tracking agent' and 'wellness monitoring' workflow but provides no warning about handling sensitive health data, consent, retention, or access controls. In a multi-agent/Discord-integrated system, this omission can lead users to store or transmit protected personal information in logs, workspaces, or channels without adequate safeguards.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description says this is a 'complete toolkit' for creating autonomous agents and managing Discord channels, which is broad enough to trigger on many common setup or coordination requests. Over-broad invocation scope increases the chance the skill is selected in contexts where users did not intend file changes, service restarts, or channel administration.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow instructs the operator to run scripts that create files, update gateway config, restart the gateway, and optionally create cron jobs, but the skill lacks a clear up-front warning that these are state-changing and potentially disruptive operations. Users may invoke it assuming it is advisory when it actually performs persistent infrastructure and communication changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script unconditionally writes SOUL.md and HEARTBEAT.md into the supplied workspace using shell redirection, which will overwrite existing files without checking whether they already exist or prompting the operator. In this skill's context, the workspace path is user-controlled and may point to an existing agent or sensitive directory, so accidental data loss or corruption is realistic even if there is no obvious code injection.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script automatically patches the gateway configuration and triggers an implied restart immediately after assembling the config, with no final review/confirmation gate. Because this skill manages autonomous agents and Discord bindings, a mistaken or manipulated invocation can change routing, add agents, and disrupt service availability or behavior across the environment.

Session Persistence

Medium

Category: Rogue Agent
Content: - **Emoji** (e.g., "🔬") - **Specialty** (what the agent does) - **Model** (which LLM to use) - **Workspace** (where to create agent files) - **Discord channel ID** (optional) #### 2. Run Creation Script
Confidence: 76% confidence
Finding: The skill is explicitly designed to create autonomous agents with self-contained workspaces, generated identity/heartbeat files, optional cron jobs, and persistent memory. This introduces durable autonomous behavior and long-lived state that can continue acting or influence future sessions beyond the original user request.

Session Persistence

Medium

Category: Rogue Agent
Content: - `--emoji` (required) - Agent emoji - `--specialty` (required) - What the agent does - `--model` (required) - LLM to use (provider/model-name) - `--workspace` (required) - Where to create agent files - `--discord-channel` (optional) - Discord channel ID to bind **Output:**
Confidence: 79% confidence
Finding: The arguments and outputs confirm that the skill creates agent files, updates gateway configuration, and can establish ongoing automation. Persistent agent artifacts and bindings increase the blast radius of mistakes because the changes remain active after the initial setup step.

Static analysis

No suspicious patterns detected.