Coding Team Setup
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files and instructions are internally consistent with a local setup wizard that reads/writes OpenClaw config and creates team manifests; it requests no credentials and does not show obvious exfiltration or unrelated privileges.
This appears to be a legitimate local setup wizard for multi-agent teams. Before running it: 1) Back up ~/.openclaw/openclaw.json. 2) Inspect wizard/setup.js (which you have) to confirm it only writes expected team files and merges allowAgents (it does). 3) Pay attention to model IDs the wizard writes — replace any default model IDs you don't recognize (e.g., entries prefixed with 'custom-llmapi-...' or vendor-like names) with your approved model/provider IDs. 4) Run the script in an environment where file writes to your OpenClaw directory are acceptable. If you want extra caution, run it once with a temporary OPENCLAW_DIR pointing to a disposable directory to preview generated files.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
64/64 vendors flagged this skill as clean.
Risk analysis
No visible risk-analysis findings were reported for this release.