Multi-Agent Brand Studio

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:57 PM UTC
• Version: 1.0.3

Overview

The skill is not obviously malicious, but it makes lasting OpenClaw and Telegram changes and broadens trusted local execution enough that it needs careful review before installation.

Install only if you intentionally want a persistent multi-agent social media operations setup. Before running setup, back up ~/.openclaw/openclaw.json, review scaffold.sh and patch-config.js, prefer OpenClaw secrets for the Telegram bot token, avoid trusting entire Homebrew directories unless you understand the local executable risk, skip or pin the optional QMD install, and verify the cron jobs and approval workflow before connecting real brand channels.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: assets/skills/qmd-setup/SKILL.md:46
• Finding: Unpinned Global Installation of a Third-Party QMD Package## Vulnerability Details **File Location**: `assets/skills/qmd-setup/SKILL.md:46-55` **Additional Locations**: `SKILL.md:300`, `scripts/patch-config.js:272-274` **Vulnerability Type**: Unverified and unpinned global dependency installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ### Step 2: Install QMD **Recommended: Install with bun (faster):** ```bash bun install -g @tobilu/qmd ``` **Alternative: Install with npm:** ```bash npm install -g @tobilu/qmd ``` ``` The configuration patcher also recommends the same unpinned installation: ```js console.log("[TIP] For enhanced semantic search memory, install QMD:"); console.log(" bun install -g @tobilu/qmd"); console.log(" Then re-run this script, or use the qmd-setup skill."); ``` ### Technical Analysis The setup instructions install the latest available version of `@tobilu/qmd` globally without an exact version, lockfile, checksum, signature verification, or documented package-content review. Package manager installation can execute package lifecycle scripts and install executable files into globally accessible binary directories. Because no version is pinned, the effective code installed can change after this Skill has been reviewed. A compromised package release, maintainer account, registry entry, or transitive dependency could therefore introduce arbitrary code into the user's environment. The dependency is optional, so globally installing it is not necessary for the Skill's core file-based memory functionality. ### Attack Path 1. An attacker compromises the `@tobilu/qmd` package, one of its dependencies, or a maintainer's publishing credentials. 2. The attacker publishes a malicious package version containing an installation script or malicious runtime executable. 3. A user follows the Skill's recommendation and runs `bun install -g @tobilu/qmd` or `npm install -g @tobilu/qmd`. 4. The package manager dow ...[truncated 872 chars]
• Remediation: ## Remediation Suggestions 1. Pin QMD to an exact, reviewed version rather than installing the latest release: ```bash npm install --global --save-exact @tobilu/qmd@REVIEWED_VERSION ``` 2. Document and verify the expected package integrity hash and registry provenance before installation. 3. Review the package's lifecycle scripts and dependency tree for the pinned release. 4. Prefer a project-local or isolated installation over a global installation. 5. Use a lockfile where the installation model permits one. 6. Disable package lifecycle scripts during installation when they are not required: ```bash npm install --ignore-scripts --save-exact @tobilu/qmd@REVIEWED_VERSION ``` 7. Keep file-based memory as the default and require explicit, informed user approval before installing this optional component. 8. Document removal and incident-response procedures for a compromised package release.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/patch-config.js:224
• Finding: Overly Broad Trust of Potentially User-Writable Executable Directories## Vulnerability Details **File Location**: `scripts/patch-config.js:224-236` **Additional Location**: `references/troubleshooting.md:61-74` **Vulnerability Type**: Excessive executable trust and insufficient least-privilege controls **Risk Level**: Medium **Vulnerable Code Snippet**: ```js // v2026.2.24+ restricts safe-bin trusted dirs to /bin, /usr/bin only. // Creator and Engineer need Homebrew paths for exec (uv run, CLI tools). if (!patched.tools.exec) patched.tools.exec = {}; if (!patched.tools.exec.safeBinTrustedDirs) { patched.tools.exec.safeBinTrustedDirs = [ "/bin", "/usr/bin", "/opt/homebrew/bin", "/usr/local/bin", ]; console.log( "[SET] tools.exec.safeBinTrustedDirs (Homebrew paths for Creator/Engineer exec)" ); } ``` The troubleshooting documentation repeats the broad configuration: ```json "tools": { "exec": { "safeBinTrustedDirs": ["/bin", "/usr/bin", "/opt/homebrew/bin", "/usr/local/bin"] } } ``` ### Technical Analysis The patcher expands OpenClaw's trusted executable directories from immutable system paths to the entirety of `/opt/homebrew/bin` and `/usr/local/bin`. These directories are commonly managed by package managers and may be writable by the current user or contain symlinks to package-managed files. Trusting a complete directory means unrelated present and future executables within that directory can enter the trusted execution boundary. This exceeds the minimum privileges needed to invoke a specific image-generation, QMD, or engineering tool. The configured agent matrix permits command execution for Creator, Worker, and Engineer. Consequently, a replaced executable, malicious newly installed binary, or executable selected through PATH resolution could run in one of those agents' permission contexts. ### Attack Path 1. An attacker gains the ability to place or replace an executable in `/opt/homebrew/bin` or `/usr/local ...[truncated 1499 chars]
• Remediation: ## Remediation Suggestions 1. Do not automatically trust all of `/opt/homebrew/bin` or `/usr/local/bin`. 2. Retain `/bin` and `/usr/bin` as the default trusted directories. 3. Use an exact executable allowlist or verified absolute executable paths where supported. 4. Require explicit user approval before adding each non-system executable. 5. Before trusting a path, verify: - The resolved path is not unexpectedly redirected by a symlink. - The executable and parent directories have trusted ownership. - Group and world write permissions are disabled. - The executable matches an expected cryptographic hash. 6. Create a dedicated directory containing only reviewed tools instead of trusting general package-manager directories. 7. Apply separate executable policies per agent. Creator should receive only the required image-generation executable, while Engineer and Worker should receive only tools needed for a specific task. 8. Update `references/troubleshooting.md` so it does not recommend broad directory trust as the default fix.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:118
• Finding: Telegram Bot Token Stored in Plaintext Configuration by Default## Vulnerability Details **File Location**: `SKILL.md:118-126` **Additional Location**: `scripts/telegram-topics.js:91-108` **Vulnerability Type**: Plaintext storage of a long-lived authentication credential **Risk Level**: Low **Vulnerable Code Snippet**: ```text #### Phase A: Confirm Bot Token 1. Check `openclaw.json` for `channels.telegram.botToken` 2. If present → skip to Phase B 3. If missing → guide the user: - "Open Telegram, search for **@BotFather**" - "Send `/newbot` and follow the prompts to create a bot" - "Copy the bot token and paste it here" - Write the token into `openclaw.json` at `channels.telegram.botToken` ``` The Telegram utility subsequently reads the plaintext token from that file: ```js function resolveToken(args) { if (args.token) return args.token; if (args.config) { try { const configPath = args.config.startsWith("~") ? path.join(process.env.HOME, args.config.slice(1)) : args.config; const config = JSON.parse(fs.readFileSync(configPath, "utf8")); const token = config?.channels?.telegram?.botToken || config?.channels?.telegram?.credentials?.botToken; if (token) return token; console.error( "[ERROR] No botToken found in config at channels.telegram.botToken" ); process.exit(1); } catch (err) { console.error(`[ERROR] Failed to read config: ${err.message}`); process.exit(1); } } ``` ### Technical Analysis The default onboarding flow instructs the user to place a long-lived Telegram bot token directly in `openclaw.json`. Centralized OpenClaw secret management is mentioned only later as optional rather than being used as the default credential path. Any local user or process that can read this configuration can recover the token. The configuration patcher also creates timestamped copies of `openclaw.json`, which can extend cre ...[truncated 1594 chars]
• Remediation: ## Remediation Suggestions 1. Make OpenClaw secret management the default onboarding path rather than an optional post-installation step. 2. Store only a secret reference in `openclaw.json`; do not store the token value directly. 3. Ensure credential-bearing files are created with owner-only permissions, such as `0600`. 4. Modify backup logic to avoid copying plaintext secrets, or encrypt and access-control all backups. 5. Retain `--config` as the preferred utility interface and remove or prominently discourage `--token`, since command-line arguments can appear in process listings and shell history. 6. Redact token values from logs, diagnostics, dry-run output, error reports, and support bundles. 7. Add setup-time permission checks that reject configuration files readable by group or other users. 8. Document immediate token rotation through BotFather if configuration or backup exposure is suspected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (30)

Ae1

High

• Category: analysis-evasion

Content

bash scripts/scaffold.sh \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

bash scripts/scaffold.sh \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

4. **(Optional) Remove the SQLite database:**
   ```bash
   rm ~/.openclaw/memory/main.sqlite
   ```

After uninstalling, agents will use file-based memory (MEMORY.md + direct file reads). This works fine for small-to-medium knowledge bases and requires no additional dependencies.

• Confidence: 89% confidence
• Finding: The skill contains a direct `rm` command targeting a local database path. Even though the path is specific and the step is labeled optional, destructive shell commands in agent-facing documentation are risky because they may be executed without validating whether the file contains data the user wants to preserve.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrase examples are broad enough to match ordinary administrative or brainstorming requests, which can cause the skill to activate when the user did not intend to install or invoke a high-impact multi-agent setup flow. In this skill, activation can scaffold workspaces, patch configuration, and alter routing behavior, so accidental invocation has meaningful side effects beyond a harmless prompt response.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The post-setup examples are open-ended operational commands like adding brands, creating posts, or updating profiles, without requiring explicit invocation boundaries, confirmation, or scoped preconditions. Because this skill manages shared memory, routing, assets, and approvals across multiple brands, broad triggers increase the chance of unintended execution, wrong-brand actions, or unauthorized modifications when a normal user request is misclassified as a skill command.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Step 2: Team Setup

**All 5 agents are installed automatically.** Do not ask the user to choose a team size.

The full team:

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 3: Run Scaffold

Execute the setup scripts to create all directories and files first:

```bash
# 1. Create directories, copy templates, set up symlinks

• Confidence: 84% confidence
• Finding: The skill directs execution of local shell and Node scripts that create directories, symlinks, cron jobs, and modify ~/.openclaw/openclaw.json, establishing persistent changes to the user's environment. Because the skill content provides no integrity verification, dry-run, or explicit trust boundary for those scripts, a malicious or tampered skill package could use this setup path to persist unwanted configuration or automation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Step 4: Telegram Setup

This step uses a **guided flow** — do not ask the user for raw chat IDs or thread IDs.

#### Phase A: Confirm Bot Token

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The job message at L65 is written entirely in Traditional Chinese and directs the agent's task behavior in that language. In a config file that appears otherwise language-neutral, this imposes a specific language without any opt-in, choice, or justification, which matches the locale/language policy violation criteria.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## [Your Market]

### Data Protection
- Don't collect personal data without consent
- Don't share customer information across brands
- Include privacy disclaimers where required
- DMs/comments containing personal data: handle, don't store

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Multiple owner-visible message templates are written entirely or partially in Traditional Chinese, including status, progress, result, and blocked-message text. The document does not indicate that this language requirement is optional, user-selected, or justified as a region-specific constraint, which creates a language/locale policy issue.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The uninstall instructions include deleting the SQLite database file without an explicit warning that this permanently removes indexed memory data and may disrupt recovery or rollback. While framed as optional cleanup, this is still a destructive action that an agent or user could execute mechanically, causing unintended data loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill directs the agent to perform web research and download reference images, but it does not disclose that network access and third-party retrieval will occur. This can expose user queries, brand plans, or browsing patterns to external services and may fetch untrusted content into the workspace without an approval step.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Read the brand** — Profile, voice, visual identity, content guidelines
2. **Quick research** — web_search for trends, competitor posts, platform context
3. **Write copy** — In the brand's content language, adapted to platform
4. **Generate visuals** — Matching product shots, lifestyle images, graphics
5. **Package** — Deliver copy + image paths + platform specs as one unit

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to write generated media and memory artifacts to local storage without any requirement for user awareness, consent, or confirmation. In an agent environment, silent file creation and persistence can surprise users, leak sensitive task context into durable notes, and expand the amount of data retained beyond what is necessary for the immediate task.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to persist task-derived findings into `memory/YYYY-MM-DD.md` and `MEMORY.md` without any built-in requirement to obtain user consent, minimize content, or warn that information from a task may be retained beyond task completion. Persistent storage increases the chance that sensitive, proprietary, or regulated information from a research brief is retained and later exposed to unrelated tasks or operators.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates sending a callback containing result summaries and file paths to another session, and even provides fallback routing logic, but does not require checking data sensitivity or informing the user that task outputs will be transmitted cross-session. This creates a data-flow channel where sensitive research outcomes, internal paths, or contextual identifiers can be shared beyond the current execution context, potentially violating least-privilege and user expectations.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Workflow principles:**
- Leader owns the content schedule — Creator receives the plan, Leader handles timing.
- All inter-agent routing goes through Leader. If Creator needs deep research (`[NEEDS_INFO]`), Leader routes to Researcher — agents never communicate directly.
- "Atomic tasks" means don't bundle cross-capability work (write copy + generate image + publish → 3 tasks). It does NOT mean micro-managing an agent's internal steps.

### Brand Scope in Briefs

• Confidence: 77% confidence
• Finding: The skill explicitly relies on persistent same-session context and instructs reuse of agent sessions for revisions and serial work, which can cause cross-task context bleed, stale assumptions, or inadvertent disclosure of prior task data. In a multi-agent orchestration system, session persistence increases the chance that sensitive owner or brand information is reused outside the minimum scope needed for a new task.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The required brief text includes Chinese ('修改完先回報') and is mandated as 'Always add', which imposes a specific language choice. This is a locale/language policy concern because the file does not offer an opt-in or alternative language selection for users or operators.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The hard-rule status template uses Chinese task text and labels such as '進行中' as the required owner-facing format. Because this is presented as mandatory and no language/locale choice is offered, it violates the policy against forcing a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The instruction "Owner-facing: 繁體中文 (per INSTANCE.md)" imposes a specific language for owner interactions. Under the policy, forcing a language or locale without explicit user choice or documented justification is a natural-language policy violation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The inline comments at L203 and L225 describe the reviewer as a "read-only agent," implying no local state should be created or modified for that agent. However, the loop still creates the reviewer workspace directory and copies SOUL.md and AGENTS.md into it at L201 and L209-L210, which are write operations. This is an active contradiction between documentation intent and code behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env node

/**
 * telegram-topics.js — Create forum topics in Telegram DM or supergroup
 *
 * Uses the Telegram Bot API `createForumTopic` to automatically create
 * forum topics. Works with both DM (thread mode enabled) and supergroups

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown workflow states that future auto-posting will execute at a scheduled time, which is a system action affecting external publication. Although the file requires explicit approval elsewhere, it does not include a direct warning to users that approved content may later be posted automatically once that capability is enabled.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/patch-config.js:116