Agency Orchestrator

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a real local agent orchestrator, but it needs review because it can persistently alter the user's shell/OpenClaw configuration, load code from hard-coded external paths, and store raw task text in local logs.

Install only after reviewing the setup script and local dependencies. Avoid running integrate_with_clawx.sh unless you accept edits to ~/.openclaw/openclaw.json and ~/.bash_profile, and remove or verify the hard-coded collaborative_mode.py import paths before using collaborative mode. Do not submit secrets, credentials, or sensitive business data as task prompts unless you are comfortable with them being stored in local plaintext logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises file read/write capabilities through configuration and logging paths, but does not declare permissions. Undeclared file access is risky because users and the platform cannot accurately assess what local data may be read or modified, especially when the skill also references persistent files under the user's home directory.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to orchestrate agents, but analysis indicates it also modifies user configuration, edits shell startup files, adds aliases, and sources shell config for immediate effect. Those actions create persistence and alter the execution environment, which is far more invasive than the stated purpose and could be abused to hijack commands, weaken user control, or conceal additional behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file prepends hard-coded local directories to sys.path, causing imports to resolve from locations outside the skill boundary. This enables unintended or malicious code from those directories to be loaded at runtime, undermines reproducibility, and is especially risky in an orchestrator that will process arbitrary tasks and may run in privileged local environments.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script's behavior materially exceeds the stated purpose of a multi-agent orchestration skill by performing local installation and persistent user-environment changes. This kind of scope mismatch is dangerous because it can hide system-modifying side effects behind an unrelated capability description, reducing informed user consent and making risky changes easier to smuggle into a skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script persistently appends environment variables, PATH entries, and a shell alias to ~/.bash_profile, which changes future shell behavior beyond the current session. In the context of a task-orchestration skill, this is more dangerous because it grants lasting command-discovery and execution influence that is not necessary for core orchestration functionality and could be abused for persistence or command hijacking if the referenced paths later change.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly documents persistent local logging of orchestrator, learning, collaboration, and integration activity, but does not warn users that task content and collaboration metadata may be retained on disk. In a multi-agent orchestration skill, prompts can contain sensitive business, personal, or proprietary data, so undocumented retention increases privacy and data exposure risk through local compromise, backups, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persistently stores raw task descriptions in ~/.openclaw/agency-agents-zh/logs/clawx_integration.json without user notice, consent, retention limits, or sanitization. Task text may contain secrets, personal data, business plans, credentials, or customer information, and local persistence increases the risk of unintended disclosure to other local users, backups, or later processes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script writes to the user's shell startup file without prompting, warning, or obtaining consent. Silent persistent configuration changes are risky because users may not realize their future shell sessions are altered, and in this skill context the behavior is unjustified by the advertised agent-coordination function, increasing the chance of deceptive or overly broad modification.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.