Security audit

Agent Orchestration Kit

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed OpenClaw multi-agent orchestration setup kit with broad but purpose-aligned configuration changes that users should review before applying.

Install only if you want OpenClaw-wide multi-agent orchestration. Review the dry-run output carefully, especially session visibility, internal hooks, heartbeat, agent-to-agent settings, and trusted exec paths; keep the generated backup so you can restore openclaw.json if the configuration is broader than you intended.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The safety section gives mixed signals about networked and external actions: it says 'web_search / web_fetch' is safe to do freely, but also says to ask first for 'Anything that leaves the machine.' In practice, web access inherently sends data off-host, so this ambiguity can cause the orchestrator to autonomously transmit prompts, URLs, tokens in query strings, or workspace-derived context without explicit approval. Because this is the leader role with broad authority to coordinate and summarize owner context, the ambiguity is more dangerous than it would be in a narrower skill.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The invocation guidance is extremely broad, including catch-all phrases like 'anything involving agents working together on tasks,' which can cause the skill to activate outside its intended scope. Overbroad activation increases the chance that powerful orchestration behaviors, config changes, or agent-management flows are introduced in contexts where they were not explicitly requested or appropriately reviewed.

Hidden Instructions

High

Category: Prompt Injection
Content: ---  ## Task Completion & Callback
Confidence: 95% confidence
Finding: The file contains hidden operational instructions in an HTML comment that direct the agent to perform an out-of-band callback using routing data from the task brief or A2A context. Because AGENTS.md is treated as executable guidance for agent behavior, concealed instructions can bypass user visibility and influence control flow, data routing, and reporting destinations in ways that are hard to audit. In a multi-agent environment, this increases the risk of prompt injection, unauthorized message exfiltration, or confused-deputy behavior if an attacker can modify the file or task brief.

Hidden Instructions

High

Category: Prompt Injection
Content: ---  ## Task Completion & Callback
Confidence: 96% confidence
Finding: The file contains hidden orchestration instructions embedded in an HTML comment that direct the agent to send a callback to an externally supplied session identifier after task completion. Because these instructions are not part of the visible reviewer guidance and can override normal reporting behavior, they create a prompt-injection channel that may exfiltrate review outputs or redirect agent actions to an attacker-controlled destination.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/patch-config.js:45