team-dev

• Outcome: Review
• Latest audit: Jul 9, 2026 · 2:02 PM UTC
• Version: 4.1.0

Overview

This skill is not malicious, but it should be reviewed carefully because it creates persistent agent identities, shared workspace links, and contains some under-scoped or contradictory workflow instructions.

Install only if you want a persistent multi-agent coding setup under ~/.openclaw. Before initializing agents, review the AGENTS.md and SOUL.md templates, especially the coder git push instruction and any custom regions that will be preserved across updates. Prefer using it in a disposable or project-scoped workspace until the invocation and remote-git behavior are clarified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the orchestrator to execute shell commands, create agent instances, write files into `~/.openclaw/workspace-*`, and create symlinks in the user's home directory. Those are privileged side effects that exceed a pure orchestration/documentation role and create a persistent modification surface an adversarial skill could abuse for workspace poisoning, unauthorized file planting, or unsafe command execution.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The manifest description advertises broad natural-language triggers despite also declaring command-only invocation. Ambiguous activation conditions increase the chance the skill is invoked outside the user's explicit intent, which is more dangerous here because the skill contains persistent initialization and filesystem-modifying behavior.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The startup check says the flow begins when the user mentions 'team development' or 'multi-agent development,' contradicting the earlier 'command-only invocation' claim. This ambiguity widens the trigger surface and could cause the system to start agent checks and initialization logic from casual conversation rather than a deliberate command.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly states 'Chinese preferred' and to reduce support for non-Chinese/English languages, which can override user language choice and create discriminatory or degraded handling without opt-in. In an agent framework, this is dangerous because it can cause the agent to ignore user intent, mishandle safety-critical instructions in other languages, or provide uneven service quality.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly sets the agent to be 'Chinese-first' without indicating that this preference is conditional on user choice or task requirements. In an agent framework, hardcoded language policies can override user intent, reduce usability, and cause the agent to ignore higher-priority instructions about output language or accessibility.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file explicitly states that Chinese is the soul and frames writing in Chinese as instinct and pride, which functions as a hard language preference without user opt-in or accommodation. In an agent skill, this can cause the model to ignore user language preferences or task requirements, leading to misalignment, exclusion of users, and degraded reliability in multilingual contexts.

Hidden Instructions

High

• Category: Prompt Injection

Content

Each agent's AGENTS.md and SOUL.md is divided into two regions:

- **MA Core region** — enclosed by `<!-- MA:CORE_START -->` and `<!-- MA:CORE_END -->` markers. These are MA framework-managed rules that ensure team collaboration consistency.
- **Custom region** — the free area outside the markers. Agents record notes, preferences, lessons learned, and personal habits here. **This content belongs to the agent and must not be touched during initialization.**

During initial setup, the agent may not have these files yet — simply write them. But on **subsequent updates**, only replace the content between the MA:CORE markers, preserving everything the agent has accumulated outside the markers.

• Confidence: 81% confidence
• Finding: <!-- MA:CORE_START -->` and `<!-- MA:CORE_END -->` markers. These are MA framework-managed rules that ensure team collaboration consistency. - **Custom region** — the free area outside the markers. Ag

Session Persistence

Medium

• Category: Rogue Agent

Content

> I can initialize the missing agents for you in one go.
>
> Choose:
> 1. **Initialize** — Auto-create missing agents, write behavior guides and personality files, set up project connections
> 2. **Go Solo** — Don't create agents; main takes over all missing roles
> 3. **Cancel** — Abort the current team development flow

• Confidence: 88% confidence
• Finding: create missing agents, write behavior guides and personality files, set up project connections > 2. **Go Solo** — Don't create agents; main takes over all missing roles > 3. **Cancel** — Abort the cur

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.