Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Markdown-only OpenClaw skill for building a multi-agent HQ documentation package, with no evidence of hidden execution, credential access, persistence, or exfiltration.
Install this if you want Chinese-language guidance for creating an OpenClaw multi-agent HQ documentation skeleton. Review the generated file list before letting an agent write many workspace files, and ask for English output or narrower triggers if you do not want Chinese-only onboarding material.
This markdown file uses a single forced language throughout, and there is no indication that the skill is region-specific or that users may opt into this locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The activation condition is very broad, triggering on general requests about multi-agent workflows, dispatching systems, onboarding packages, and related concepts. Overly broad auto-invocation can cause the skill to be selected in contexts where it is not the best fit, increasing the chance of unintended file generation, workflow steering, or privilege overreach in agentic environments.
The eval prompts are broad requests for setting up an OpenClaw environment and organizational workflow, but they do not clearly bound the trigger to this specific skill versus general setup/help requests. That can cause over-triggering, where the skill is invoked for unrelated OpenClaw installation or workflow-design queries, reducing routing precision and potentially surfacing unnecessary file-generation or system-organization behaviors in the wrong context.
All eval prompts are written in Chinese and implicitly expect Chinese interaction, but the skill metadata does not document a locale requirement or user opt-in. This can bias triggering and output behavior toward Chinese-only usage, causing mismatches for users in other languages and making routing less predictable across locales.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
],
"low_risk_changes": [
{
"file": "skills/openclaw-multi-agent-hq-builder/SKILL.md",
"change": "Added explicit references to references/test-prompts.md and references/publish-checklist.md in Bundled resources"
}
]
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
],
"low_risk_changes": [
{
"file": "skills/openclaw-multi-agent-hq-builder/SKILL.md",
"change": "Added explicit references to references/test-prompts.md and references/publish-checklist.md in Bundled resources"
}
]
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- `references/acceptance-checklist.md`
- `references/test-prompts.md`
- `references/publish-checklist.md`
- `skills/skill-creator/SKILL.md`（仅提取测试/评测相关要求）
采用的快速判断维度：
1. 是否应该触发
The entire installation guide is written exclusively in Chinese and presents mandatory setup and acceptance instructions without any indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking environments. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown file presents all instructions and examples exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-speaking audience. Under the policy rule for language/locale constraints, forcing a single language without opt-in is a natural-language policy concern.
The release document is written entirely in Chinese and includes a Chinese status value (正式版) without any indication that the skill is region-specific or that users may choose another language. This can constitute a natural-language locale policy issue because the file implicitly enforces one language rather than offering opt-in or documenting the constraint.
This markdown file consists of user-facing test prompts and expectations entirely in Chinese, with no indication that the skill supports multiple languages or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.