team-dev

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 4.1.0

Overview

The skill is a disclosed multi-agent development workflow, but it can make persistent changes to local agent identities and workspace access, and one role contains a contradictory remote git push instruction.

Install only if you are comfortable with this skill creating and repairing persistent OpenClaw agent workspaces, writing future-loaded behavior/personality files, and linking agents to your shared projects directory. Review or remove the `git push origin feature/xxx` instruction before using it on private repositories, and prefer explicit per-action approval, project-scoped access, and rollback for identity-file changes.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:414

Finding

Unvalidated Persistent Agent Instructions Enable Cross-Session Memory Poisoning

Content

View full analysis

If an agent is registered but key files are missing (e.g., the agent was manually cleaned up), main should auto-repair and mark it as "⚠️ Restored" rather than "✅" in the initialization report. ## Agent Behavior Guide Sync > **Design purpose**: Each agent's AGENTS.md/SOUL.md consists of two parts — MA framework unified rules (MA:CORE) + agent personalization. This section defines the merge mechanism, ensuring the framework rules evolve uniformly while preserving each agent's accumulated personalization. ### Core Principle: Merge, Don't Overwrite Each agent's AGENTS.md and SOUL.md is divided into two regions: - **MA Core region** — enclosed by `` and `` markers. These are MA framework-managed rules that ensure team collaboration consistency. - **Custom region** — the free area outside the markers. Agents record notes, preferences, lessons learned, and personal habits here. **This content belongs to the agent and must not be touched during initialization. ...[truncated 3037 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:335

Finding

Persistent Shared-Project Symlinks Violate Least-Privilege Isolation

Content

View full analysis

This way, when the agent is dispatched, it can access project code and docs in main's workspace via `projects/`. **⑤ Repeat for All Missing Agents** Repeat steps ①–④ for each missing agent (reviewer, tester, auditor, publicist). Full mapping: | Agent | AGENTS.md Template Source (priority) | SOUL.md Template Source (priority) | Write Target Workspace | Symlink Command | |-------|--------------------------------------|------------------------------------|------------------------|-----------------| | coder | `skills/team-dev/coder/AGENTS.md` → `projects/ma/coder/AGENTS.md` | `skills/team-dev/coder/SOUL.md` → `projects/ma/coder/SOUL.md` | `~/.openclaw/workspace-coder/` | `ln -s ~/.openclaw/workspace/projects ~/.openclaw/workspace-coder/projects` | | reviewer | `skills/team-dev/reviewer/AGENTS.md` → `projects/ma/reviewer/AGENTS.md` | `skills/team-dev/reviewer/SOUL.md` → `projects/ma/reviewer/SOUL.md` | `~/.openclaw/workspace-reviewer/` | `ln -s ~/.openclaw/workspace/projects ~/.openclaw/workspace-reviewer/projects` | | tester | `skills/team-dev/tester/AGENTS.md` → `projects/ma/tester/AGENTS.md` | `skills/team-dev/tester/SOUL.md` → `projects/ma/tester/SOUL.md` | `~/.openclaw/workspace-tester/` | `ln -s ~/.openclaw/workspace/projects ~/.openclaw/workspace-tester/projects` | | auditor | `skills/team-dev/auditor/AGENTS.md` → `projects/ma/auditor/AGENTS.md` | `skills/team-dev/auditor/SOUL.md` → `projects/ma/auditor/SOUL.md` | `~/.openclaw/workspace-auditor/` | `ln -s ~/.openclaw/workspace/projects ~/.openclaw/workspace-auditor/projects` | | ...[truncated 2391 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: coder/AGENTS.md:400

Finding

Mandatory Git Push Can Disclose Source Code to an Unvalidated Remote

Content

View full analysis

/` - All operations are local — no remote push required - Single branch `main` — no feature branches needed - main runs `git init` + initializes project structure at Stage 0 - coder works directly on the `main` branch at Stage 4/6, running `git add && git commit` - No merges needed — all operations are linear on `main` - No remote push/pull — all agents inherit the same workspace via spawn ``` ### Technical Analysis The top-level workflow declares that all operations are local and that no remote push or pull is required. However, the coder's persistent operating instructions make `git push origin feature/xxx` a mandatory checklist item. Git resolves `origin` from repository-local configuration. The workflow does not validate the resolved remote URL, restrict acceptable hosts, confirm repository ownership, inspect credential behavior, or ask the user ...[truncated 1564 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

The merge scheme preserves arbitrary custom content outside MA:CORE markers in persistent AGENTS.md/SOUL.md files and instructs future agents to keep it intact. That creates a hidden-instruction persistence channel where unreviewed content can survive updates and continue influencing spawned agents over time.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md

Each agent's AGENTS.md and SOUL.md is divided into two regions:

- **MA Core region** — enclosed by `<!-- MA:CORE_START -->` and `<!-- MA:CORE_END -->` markers. These are MA framework-managed rules that ensure team collaboration consistency.
- **Custom region** — the free area outside the markers. Agents record notes, preferences, lessons learned, and personal habits here. **This content belongs to the agent and must not be touched during initialization.**

During initial setup, the agent may not have these files yet — simply write them. But on **subsequent updates**, only replace the content between the MA:CORE markers, preserving everything the agent has accumulated outside the markers.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · auditor/AGENTS.md (reported line 8)May include surrounding context.

md

> Absorbed change-management: CR traceability (change baseline comparison), self-improvement (retrospective audit + recurring issue detection)


<!-- MA:CORE_START -->
<!-- ROUTING:START -->
## Routing Rules

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The file contains hidden comment-delimited control sections and embedded routing instructions that alter agent behavior outside normal visible task content. Even if intended for orchestration, hidden instructions are risky because they can override user expectations, obscure agent decision logic, and create a channel for prompt injection or covert policy manipulation in a multi-agent system.

Content

Scanner excerpt · coder/AGENTS.md (reported line 8)May include surrounding context.

md

> Absorbed: spec-kit constitution (constitutional constraints on design), analyze (design consistency checks)


<!-- MA:CORE_START -->
<!-- ROUTING:START -->
## Routing Rules

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · main/AGENTS.md (reported line 14)May include surrounding context.

md

---

<!-- MA:CORE_START -->

## 1. Core Red Lines 🔴

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · main/AGENTS.md (reported line 23)May include surrounding context.

md

| Red Line | Rule | Correct Approach |
|------|------|---------|
| **Red Line 1** | Main does not code | Delegate to coder + reviewer for pair completion |
| **Red Line 2** | Main does not write documentation | Delegate to publicist, make good use of humanwrite skill |
| **Red Line 3** | Main does not audit | Delegate to auditor |
| **Red Line 4** | Main does not test | Delegate to tester |
| **Red Line 5** | Main serves the user well | Respond promptly, do not get buried in tasks and neglect the user |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · publicist/AGENTS.md (reported line 7)May include surrounding context.

md

> Incorporates spec-kit: constitution (constitution influences document style and content)


<!-- MA:CORE_START -->
<!-- ROUTING:START -->
## Routing Rules

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description advertises broad natural-language triggers like 'team development,' while the body claims command-only invocation. Ambiguous activation cues increase the chance the skill runs in contexts the user did not intend, which is more dangerous here because the skill can perform administrative checks and local environment mutation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document presents the red lines as inviolable rules requiring delegation of coding, docs, audit, and testing. Later, the single-agent fallback explicitly says main handles design/coding, review, testing, audit, and documentation, which directly contradicts the earlier stated intent rather than merely omitting nuance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The startup section explicitly says the flow begins when the user mentions 'team development' or 'multi-agent development,' contradicting the earlier command-only safety claim. That inconsistency broadens the trigger surface for a skill that can enumerate agents, create persistent workspaces, and write identity files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs execution of administrative CLI commands such as openclaw agents list, openclaw agents add, and ln -s against user-home workspaces. Those actions are not necessary for ordinary spec-to-delivery orchestration and expand the blast radius from project automation to host-level agent management and persistent filesystem changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill goes beyond orchestrating project work and includes logic to create agents, write AGENTS.md/SOUL.md into ~/.openclaw workspaces, and repair symlinks and identity files in the user's home directory. That gives a user-invocable workflow persistent system-mutation capabilities that can alter future agent behavior and local environment state, which is risky even if framed as setup automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The initialization flow creates agent instances, writes persistent AGENTS.md/SOUL.md files, and creates symlinks in ~/.openclaw, but the skill description does not front-load that this workflow modifies local agent workspaces. Users may invoke what appears to be a development orchestrator without understanding it will change persistent local state.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The 'Initialize' option explicitly creates missing agents and writes behavior/personality files so that future spawned sessions auto-load those identities. This establishes persistent cross-session state that can outlive the current task and affect later runs, increasing the impact of any malicious or erroneous identity content.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md

> I can initialize the missing agents for you in one go.
>
> Choose:
> 1. **Initialize** — Auto-create missing agents, write behavior guides and personality files, set up project connections
> 2. **Go Solo** — Don't create agents; main takes over all missing roles
> 3. **Cancel** — Abort the current team development flow

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · coder/AGENTS.md (reported line 176)May include surrounding context.

md

| # | Rule | Application |
|---|------|------|
| 1 | **All loops must have a fixed upper bound.** Prohibit while(true) that may loop infinitely or recursion without termination condition | Check in every loop body whether the exit condition can never be reached |
| 2 | **Avoid frequently creating large objects on critical paths.** Use object pools for buffers >10MB, thread pools, database connection pools. Trust GC for ordinary objects; don't introduce object pool complexity to save a few KB. | In Java: use pools only for very large objects, trust modern GC for the rest |
| 3 | **Public methods containing business logic must have at least 2 assertions.** Entry assertion (precondition) + exit assertion (postcondition). Simple getters/setters/delegation methods are exempt from this rule. | assert param != null; assert result > 0; |
| 4 | **All assertions must be statically provable.** Assertion conditions must be verifiable through code review, not "it should be right" | assert list.size() == expectedSize; |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction states 'Communication language: Chinese preferred' and explicitly says to 'Reduce support for non-Chinese/English languages.' This is a natural-language locale policy constraint that does not offer the user a language choice or opt-in, so it risks violating language/locale neutrality requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Lines L22-L25 define inviolable red lines forbidding main from coding, writing documentation, auditing, and testing, reinforced by the self-check at L28. But L36 and L70 say simple tasks may be completed by main itself, which directly conflicts with the earlier prohibition for task types that would naturally involve coding or documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L22 declares 'Main does not code' as a red line, but L70's requirement triage says 'Simple → handle yourself.' In a team development context, simple user requests can still be coding tasks, so the operational instruction contradicts the stated prohibition.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L24 states 'Main does not audit' and says auditing must be delegated to the auditor. However, L71 instructs main to perform an 'Audit Review' assessing whether the auditor omitted anything and whether standards were strict enough, which is an auditing function in substance and contradicts the earlier rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction "Notify the user immediately when each agent finishes" appears in an otherwise English-only operating policy and does not offer any language or locale choice. This can violate language/locale policy when users expect responses in their own language unless they explicitly opt into English-only behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The persona explicitly instructs the agent to provide periodic progress reports, immediately notify on each agent completion, and maintain 'no silence — ever' behavior without requiring user opt-in. In a multi-agent development skill, this can cause unsolicited messages, excessive disclosure of internal workflow state, and reduced user control over communication cadence, which is a real security and safety concern when tasks may involve sensitive project details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly imposes a 'Chinese-first' policy as part of its role definition, which can override or conflict with the user's requested language and reduce user control over outputs. In a multi-agent setting, hardcoded language constraints can propagate through delegated work and cause denial of user intent, policy mismatch, or accidental disclosure risks if users expect another language for review or compliance purposes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The persona explicitly states that Chinese is the required writing language, which can override or preempt user language preference and reduce user control. In a multi-agent team-development skill, this can cause downstream outputs, specs, or documentation to be generated in an unintended language, creating usability, compliance, and coordination risks rather than direct code-execution risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly directs use of specific third-party models for reviewer and coder roles without any indication of user approval or deployer-controlled model selection. This can override expected model-governance boundaries, create unapproved data flow to particular providers, and reduce operator control over privacy, cost, or compliance requirements.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · tester/AGENTS.md (reported line 55)May include surrounding context.

md

- Boundary input → correctly rejected or handled
- Invalid input → friendly error, no crash, no info leak
- Null/empty input → no NPE
- Extra-long input → no truncation or overflow
- Concurrency / re-entrancy → no dirty data
- Time zones / encoding → no garbled text or offset

Static analysis

No suspicious patterns detected.