Coding Team Setup

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 2.2.2
• Hash: a3d16c67c858d0b25c4ed03ecc4db02b90837b9d1a9524a3ae4df91e5b6c31e9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill "coding-team-setup" is designed to configure multi-agent development teams within the OpenClaw environment. The `wizard/setup.js` script, which is the skill's entrypoint, performs extensive file system operations including reading and writing `openclaw.json`, creating agent workspaces, and generating agent-specific configuration files (`SOUL.md`, `AGENTS.md`, `TOOLS.md`, `USER.md`). While these actions involve significant system modifications and require broad permissions (`read`, `write`, `exec` as declared in `clawhub.yaml`), they are entirely consistent with the stated purpose of a setup wizard. Crucially, the `SKILL.md` and `MIGRATION_v2.1_to_v2.2.md` documentation, along with the `setup.js` code, explicitly implement and enforce security and stability best practices, such as the "Allowlist Guardrail" (merging `allowAgents` to prevent accidental overwrites) and "Mandatory Subagent Timeout Governance" (requiring robust wrappers for `sessions_spawn` calls). There is no evidence of data exfiltration, unauthorized command execution from untrusted input, persistence mechanisms beyond standard agent configuration, or obfuscation. The skill's actions are transparent, declared, and aimed at enhancing the OpenClaw environment's functionality and stability. **classification:** benign