Coding Team Setup

• Risk level: Low
• Analyzed: Mar 3, 2026, 5:35 AM
• Findings: 0
• Version: 2.2.2

Overview

The skill's files and instructions are internally consistent with a local setup wizard that reads/writes OpenClaw config and creates team manifests; it requests no credentials and does not show obvious exfiltration or unrelated privileges.

This appears to be a legitimate local setup wizard for multi-agent teams. Before running it: 1) Back up ~/.openclaw/openclaw.json. 2) Inspect wizard/setup.js (which you have) to confirm it only writes expected team files and merges allowAgents (it does). 3) Pay attention to model IDs the wizard writes — replace any default model IDs you don't recognize (e.g., entries prefixed with 'custom-llmapi-...' or vendor-like names) with your approved model/provider IDs. 4) Run the script in an environment where file writes to your OpenClaw directory are acceptable. If you want extra caution, run it once with a temporary OPENCLAW_DIR pointing to a disposable directory to preview generated files.