Team Planner

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:39 AM UTC
• Version: 1.0.0

Overview

This skill is a planning aid for designing AI-agent teams, with no code execution, persistence, credential access, or hidden data movement found.

Reasonable to install if you want help designing multi-agent workflows. Review its plans before launching agents, especially for tasks involving customer or company data, and add your own privacy, access-control, and confirmation steps before any agent touches sensitive information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning

Content

Present the team plan in this structure:

### 1. Task Summary
- Objective: [Clear statement of goal]
- Scope: [What's included]
- Complexity: [Simple/Medium/Complex]
- Recommended Approach: [Single Agent / Multi-Agent Team]

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough to match ordinary planning or collaboration requests, which can cause the skill to activate outside its intended scope. In an agentic system, over-broad activation can redirect user workflows, introduce unnecessary multi-agent orchestration, and increase exposure to downstream prompt or tool misuse even though the README itself contains no directly malicious payload.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is overly broad and can activate on generic discussion of teams, agents, or collaboration rather than a clear request for this specific skill. In an agent framework, this can cause inappropriate routing, unexpected behavior, and accidental invocation of planning logic in unrelated conversations, which is a real security and safety boundary issue even without malicious intent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage conditions are ambiguous and broad enough that the skill may be selected whenever a user mentions teams, multiple agents, or coordination, even if they are not asking for orchestration. This increases the chance of misrouting, context confusion, and unintended delegation recommendations, making the skill more dangerous in practice because it influences downstream agent behavior.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The entire example content is presented in Chinese, including headings, prompts, and outputs, with no indication that language is user-selectable or that the skill is intended only for a Chinese-language context. A skill that imposes a specific language without opt-in can violate language or locale policy.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The example explicitly suggests analyzing company user data and producing user profiles, but it provides no privacy, consent, minimization, or sensitive-data handling guidance. In a team-planning skill, example workflows strongly influence downstream agent behavior, so this omission can normalize unsafe handling of personal or regulated data.

Scope Creep

Low

• Category: Excessive Agency

Content

## What is a Skill?

A skill is a directory containing a `SKILL.md` file that provides instructions and tool definitions to an AI agent. Skills extend the capabilities of OpenClaw.

## Directory Structure

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: Line L57 states that documentation should be in English, which is a natural-language locale requirement. The file does not present this as optional or justified by a region-specific constraint, so it can conflict with the language/locale policy criteria.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The natural-language description is bilingual, but the example interaction and overall documentation imply a default Chinese interaction style without stating that users may choose their preferred language. This can create a locale/language expectation without explicit user opt-in.

Static analysis

No suspicious patterns detected.