Openclaw Team Builder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:47 AM UTC
• Version: 1.0.0

Overview

This skill should be reviewed carefully because it delegates authority to missing external agent files and describes autonomous live trading changes without enough safeguards.

Install only if you intend to use broad multi-agent orchestration with trading-related workflows and can enforce your own guardrails. Before use, require bundled or allowlisted agent definitions, keep trading and configuration changes read-only or sandboxed by default, add explicit human approval before any live deployment or trade-related action, and bound autonomous experiment loops with budgets and stop conditions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:102

Finding

Untrusted External Agent Definitions Are Adopted as Governing Instructions

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: TEAM-CORE.md:3

Finding

Skill-Defined CEO Persona Is Declared Final Authority Over Agent Workflows

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: TEAM-RESEARCH.md:15

Finding

Unbounded Autonomous Experiment Loop Can Promote Changes to Live Trading Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

| `SKILL.md` | This file — overview and quick start |

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section materially expands the skill from team discovery/composition into autonomous strategy optimization and promotion of winning configurations to live systems. In a team-builder context, documenting an agent workflow that iterates on trading parameters and can push changes live creates a dangerous capability mismatch and could enable unauthorized or high-impact operational actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly states that winning trading configurations can be promoted to live via a Config Write API, introducing write access and real-world impact far beyond a team-builder's stated purpose. If followed by an agent, this could lead to unsafe or unauthorized live trading changes, financial loss, and governance bypass.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly says it can handle "any job, project, or request," which creates an unbounded activation surface with no eligibility checks, safety boundaries, or excluded domains. In an agentic system, this can cause the planner to route sensitive, high-risk, or inappropriate tasks to downstream specialists without first determining whether the task should be refused, escalated, or constrained.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Research Lab is described as applicable to "any domain with a measurable metric," which is overly broad and encourages autonomous experiment loops in domains where optimization against a metric can be unsafe or misaligned. This is especially risky because the same section cites trading, model tuning, and data analysis, all of which can have real-world side effects if the loop is run without domain-specific guardrails and stop conditions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to 'activate any specialist' by reading a definition file and adopting its role is a broad delegation mechanism with no trust boundary, allowlist, or validation step. In an agentic system, this can enable prompt-injection or unsafe behavior inheritance from referenced agent files, especially because all referenced content must be treated as potentially adversarial.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation template uses generic imperative phrasing ('Activate [Agent Name]... Read the full agent definition...') that makes it easy for downstream users or untrusted content to trigger role-loading from arbitrary referenced files. Because the mechanism encourages importing full behavioral instructions from external markdown, it increases the risk of unintended invocation, prompt injection, and policy override attempts.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The top-level description endorses an experiment loop that can 'loop forever,' implying unbounded autonomous execution. In agent systems, this can cause resource exhaustion, runaway costs, persistent modification attempts, or repeated interaction with sensitive systems unless strict runtime controls exist elsewhere.

Content

Scanner excerpt · TEAM-RESEARCH.md (reported line 3)May include surrounding context.

md

# Research Lab — Autonomous Experiment Methodology

Adapted from Karpathy's [autoresearch](https://github.com/karpathy/autoresearch) framework. The core idea: set up a measurable experiment, run it in a fixed time budget, keep improvements, discard failures, and loop forever.

This methodology is **not limited to ML training**. It applies to any domain with a measurable metric: trading strategies, image analysis pipelines, prompt engineering, configuration tuning, data processing, and more.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file introduces a general-purpose autonomous experimentation framework spanning multiple operational domains, which is outside the declared purpose of a team-builder skill. Such scope expansion increases the chance that downstream agents treat the skill as authorization or guidance for autonomous modification tasks it should not perform.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The explicit 'LOOP FOREVER' instruction operationalizes unbounded autonomous behavior rather than describing a bounded review process. Combined with the document's cross-domain and live-system examples, this increases the likelihood of indefinite resource use and repeated unsafe changes.

Content

Scanner excerpt · TEAM-RESEARCH.md (reported line 20)May include surrounding context.

The Experiment Loop

text

LOOP FOREVER:
  1. Review current state (baseline metric, recent experiments)
  2. Propose a hypothesis — what change might improve the metric?
  3. Implement the change (modify only the in-scope file/config)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The line describes promotion of winning configurations into live use without any explicit warning, approval checkpoint, rollback control, or statement of risk. In the context of trading, omitting such safeguards can normalize autonomous high-impact changes and mislead operators or agents into treating them as routine.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 78% confidence

Finding

The phrase broadens the methodology to nearly any measurable domain, signaling uncontrolled capability expansion beyond the advertised team-builder function. While not directly exploitable on its own, this scope creep makes misuse more likely by legitimizing unrelated autonomous actions under the skill.

Content

Scanner excerpt · TEAM-RESEARCH.md (reported line 5)May include surrounding context.

md

Adapted from Karpathy's [autoresearch](https://github.com/karpathy/autoresearch) framework. The core idea: set up a measurable experiment, run it in a fixed time budget, keep improvements, discard failures, and loop forever.

This methodology is **not limited to ML training**. It applies to any domain with a measurable metric: trading strategies, image analysis pipelines, prompt engineering, configuration tuning, data processing, and more.

Source reference: `reference/autoresearch-master/program.md` and `reference/autoresearch-master/README.md`

Static analysis

No suspicious patterns detected.