Security audit

Multi Agent Dev Team

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main setup function is coherent, but it includes broad persistent optimization instructions and unsafe input handling that could affect OpenClaw configuration and workspace files.

Review carefully before installing. Use only in a trusted OpenClaw environment, avoid sensitive prompt or secret data in telemetry, do not enable the weekly optimizer unless you explicitly want cross-team configuration changes, and use simple alphanumeric team and role IDs until validation is fixed.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:175
Finding: Mandatory recurring task persistently modifies cross-team configuration and stores telemetry
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: wizard/setup.js:163
Finding: Unvalidated team name enables path traversal and regular-expression injection
Content: View full analysis
{ if (a.default === true) return true; // If we have a prefix, only remove agents with that prefix if (prefixPattern) return !prefixPattern.test(a.id); // If default team, remove agents whose id matches any selected role OR old non-prefixed agents return false; // remove all non-main for default team }); ``` ```javascript const manifestDir = path.join(openclawPath, 'workspace', 'teamtask', 'teams'); fs.mkdirSync(manifestDir, { recursive: true }); const manifestPath = path.join(manifestDir, `${teamName}.json`); fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2)); ``` ### Technical Analysis The team name comes directly from the `--team` argument or interactive input and is not validated before being used in two security-sensitive contexts. First, it is interpolated directly into a `RegExp` constructor. Regular-expression metacharacters are consequently interpreted as syntax instead of literal team-name characters. A crafted value can make the prefix expression match agent IDs belonging to other teams. Invalid syntax can also throw an exception after the configuration backup has been created, causing setup failure. Second, the same value is passed to `path.join()` as part of the manifest filename. `path.join()` normalizes traversal components but does not enforce containment. A value containing ...[truncated 1751 chars]
Remediation: View remediation
typeof id === 'string' && id.startsWith(teamPrefix) : () => false; ``` 3. If a regular expression is retained, escape every metacharacter before construction. Literal `startsWith()` comparison is preferable. 4. Resolve and verify the manifest destination before writing: ```javascript const manifestRoot = path.resolve(manifestDir); const manifestPath = path.resolve(manifestRoot, `${teamName}.json`); if ( manifestPath !== path.join(manifestRoot, `${teamName}.json`) || !manifestPath.startsWith(manifestRoot + path.sep) ) { throw new Error('Manifest path escapes the team manifest directory'); } ``` 5. Reject absolute paths, path separators, `.` components, and `..` components explicitly. 6. Validate agent IDs before filtering and show a preview of all entries that will be removed. 7. Require confirmation if any entry outside the exact selected team would be changed. 8. Write configuration atomically through a temporary file followed by a rename, and restore the backup automatically if validation or writing fails. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: wizard/setup.js:198
Finding: Unvalidated custom role ID enables agent workspace path traversal and instruction-file overwrite
Content: View full analysis
s.trim()) : [] }; ``` ```javascript for (const [roleId, role] of Object.entries(selectedRoles)) { const agentId = `${teamPrefix}${roleId}`; const isCodeArtisan = roleId === 'code-artisan'; const agentWS = isCodeArtisan ? path.join(openclawPath, 'agents', agentId, 'workspace') : workspace; newAgentIds.push(agentId); config.agents.list.push({ id: agentId, name: `${role.name} ${role.emoji}`, workspace: agentWS, model: { primary: agentModels[roleId].primary, fallbacks: agentModels[roleId].fallbacks, }, skills: ['teamtask'], }); } ``` ```javascript for (const [roleId, role] of Object.entries(selectedRoles)) { const agentId = `${teamPrefix}${roleId}`; const wsPath = path.join(openclawPath, 'agents', agentId, 'workspace'); if (!fs.existsSync(wsPath)) { fs.mkdirSync(wsPath, { recursive: true } ...[truncated 2787 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README advertises that the wizard automatically modifies openclaw.json, workspaces, manifests, and sets up a weekly cron, but it does not clearly warn users that running the setup changes local files and installs persistent scheduled behavior. In a developer-tool skill, undocumented automated state changes can lead to unintended configuration drift, persistence, or disruption of existing environments, especially when users may run the command based only on the README.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The document is explicitly structured around only two languages, with separate '## English' and '## 中文' sections, and the activation examples also mix fixed English and Chinese commands. This creates a locale constraint without stating that users may choose another language or that the limitation is intentional for a region-specific purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates per-agent telemetry logging including agent_id, skill_name, timestamp, and context, but provides no minimization, consent, access control, or redaction guidance. Because 'context' may contain prompts, code, secrets, or personal data, this creates a realistic risk of sensitive data collection and later exposure through logs or downstream analytics.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Requiring weekly optimization summaries in memory files and analytics history in a persistent directory encourages long-term retention of potentially sensitive operational data without any warning or controls. If summaries include task context, model behavior, or team activity details, they can become a durable source of confidential information leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is the Chinese-language repetition of the same telemetry requirement and has the same risk profile: it instructs persistent collection of agent skill usage events including context without privacy safeguards. Duplicating the requirement in another language broadens the chance that implementers will adopt insecure logging as standard practice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This section directs persistent storage of optimization outputs and history, again without addressing sensitivity, retention, or access restrictions. Persistent archives can accumulate confidential prompts, architecture details, or usage patterns that materially increase blast radius if the workspace is read by other agents, users, or attackers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Many user-facing descriptions and workflow texts are written only in Chinese, while labels and names are mixed English/Chinese. This can violate language/locale policy if the skill presents one language by default without offering the user a language choice or documenting that the skill is intended for a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The collaboration and notes sections contain operational instructions entirely in Chinese, which effectively imposes a specific language/locale on downstream skill authors and users. The file does not provide an opt-in, alternative language, or justification that this template is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The wizard generates TOOLS.md stating agents can use shell execution, file editing, browser automation, and agent-spawn capabilities, but the created agent config only enables the 'teamtask' skill. This creates a security-significant mismatch between documented capabilities and actual configured permissions, which can mislead operators or downstream systems into assuming broader authority and trusting unsafe workflows or prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script overwrites the user's OpenClaw configuration, rewrites agent entries, creates agent workspace files, and writes team manifests after only a generic proceed prompt, without clearly enumerating the full scope of affected paths and destructive changes. In a security-sensitive local agent environment, unclear bulk modification of config and workspaces increases the risk of unintended privilege changes, agent exposure, or loss of prior configuration state.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- Set up a multi-role collaborative development team (2–10 agents) - Need multiple teams to work in parallel with independent configurations - Need custom collaboration workflows (not limited to standard 9-step) - Need flexible role combinations and model assignments ### Quick Start

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This JSON manifest says users can define "fully custom roles via the wizard" without any stated constraints, examples, or exclusion conditions. In a manifest/context file, such unconstrained custom behavior can make the trigger scope or activation boundaries unclear compared with narrowly defined role templates.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The "custom" workflow is labeled "完全自定义协作步骤" with an empty steps array and no limitations or examples. For a manifest file, this is an ambiguous description of when and how the workflow should be used, increasing the chance of unintended or inconsistent invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt Team name (用于区分多个团队) imposes mixed-language UI text in a script that is otherwise English, without any user opt-in or explanation that the wizard is intended for a Chinese-speaking locale. This can violate language/locale policy guidance requiring choice or documented justification.
Content: No source excerpt is available for this finding.