Multi-Agent Brand Studio

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:57 PM UTC
• Version: 1.0.3

Overview

The skill is not obviously malicious, but it makes lasting OpenClaw and Telegram changes and broadens trusted local execution enough that it needs careful review before installation.

Install only if you intentionally want a persistent multi-agent social media operations setup. Before running setup, back up ~/.openclaw/openclaw.json, review scaffold.sh and patch-config.js, prefer OpenClaw secrets for the Telegram bot token, avoid trusting entire Homebrew directories unless you understand the local executable risk, skip or pin the optional QMD install, and verify the cron jobs and approval workflow before connecting real brand channels.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: assets/skills/qmd-setup/SKILL.md:46

Finding

Unpinned Global Installation of a Third-Party QMD Package

Content

View full analysis

Vulnerability Details

File Location: assets/skills/qmd-setup/SKILL.md:46-55
Additional Locations: SKILL.md:300, scripts/patch-config.js:272-274
Vulnerability Type: Unverified and unpinned global dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

### Step 2: Install QMD

**Recommended: Install with bun (faster):**
```bash
bun install -g @tobilu/qmd

Alternative: Install with npm:

bash

npm install -g @tobilu/qmd

text

The configuration patcher also recommends the same unpinned installation:

```js
console.log("[TIP]  For enhanced semantic search memory, install QMD:");
console.log("       bun install -g @tobilu/qmd");
console.log("       Then re-run this script, or use the qmd-setup skill.");

Technical Analysis

The setup instructions install the latest available version of @tobilu/qmd globally without an exact version, lockfile, checksum, signature verification, or documented package-content review.

Package manager installation can execute package lifecycle scripts and install executable files into globally accessible binary directories. Because no version is pinned, the effective code installed can change after this Skill has been reviewed. A compromised package release, maintainer account, registry entry, or transitive dependency could therefore introduce arbitrary code into the user's environment.

The dependency is optional, so globally installing it is not necessary for the Skill's core file-based memory functionality.

Attack Path

1. An attacker compromises the @tobilu/qmd package, one of its dependencies, or a maintainer's publishing credentials.
2. The attacker publishes a malicious package version containing an installation script or malicious runtime executable.
3. A user follows the Skill's recommendation and runs bun install -g @tobilu/qmd or npm install -g @tobilu/qmd.
4. The package manager dow ...[truncated 872 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin QMD to an exact, reviewed version rather than installing the latest release:

   bash

   npm install --global --save-exact @tobilu/qmd@REVIEWED_VERSION
   

2. Document and verify the expected package integrity hash and registry provenance before installation.
3. Review the package's lifecycle scripts and dependency tree for the pinned release.
4. Prefer a project-local or isolated installation over a global installation.
5. Use a lockfile where the installation model permits one.
6. Disable package lifecycle scripts during installation when they are not required:

   bash

   npm install --ignore-scripts --save-exact @tobilu/qmd@REVIEWED_VERSION
   

7. Keep file-based memory as the default and require explicit, informed user approval before installing this optional component.
8. Document removal and incident-response procedures for a compromised package release.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/patch-config.js:224

Finding

Overly Broad Trust of Potentially User-Writable Executable Directories

Content

View full analysis

Vulnerability Details

File Location: scripts/patch-config.js:224-236
Additional Location: references/troubleshooting.md:61-74
Vulnerability Type: Excessive executable trust and insufficient least-privilege controls
Risk Level: Medium

Vulnerable Code Snippet:

js

// v2026.2.24+ restricts safe-bin trusted dirs to /bin, /usr/bin only.
// Creator and Engineer need Homebrew paths for exec (uv run, CLI tools).
if (!patched.tools.exec) patched.tools.exec = {};
if (!patched.tools.exec.safeBinTrustedDirs) {
  patched.tools.exec.safeBinTrustedDirs = [
    "/bin",
    "/usr/bin",
    "/opt/homebrew/bin",
    "/usr/local/bin",
  ];
  console.log(
    "[SET]  tools.exec.safeBinTrustedDirs (Homebrew paths for Creator/Engineer exec)"
  );
}

The troubleshooting documentation repeats the broad configuration:

json

"tools": {
  "exec": {
    "safeBinTrustedDirs": ["/bin", "/usr/bin", "/opt/homebrew/bin", "/usr/local/bin"]
  }
}

Technical Analysis

The patcher expands OpenClaw's trusted executable directories from immutable system paths to the entirety of /opt/homebrew/bin and /usr/local/bin. These directories are commonly managed by package managers and may be writable by the current user or contain symlinks to package-managed files.

Trusting a complete directory means unrelated present and future executables within that directory can enter the trusted execution boundary. This exceeds the minimum privileges needed to invoke a specific image-generation, QMD, or engineering tool.

The configured agent matrix permits command execution for Creator, Worker, and Engineer. Consequently, a replaced executable, malicious newly installed binary, or executable selected through PATH resolution could run in one of those agents' permission contexts.

Attack Path

1. An attacker gains the ability to place or replace an executable in /opt/homebrew/bin or `/usr/local ...[truncated 1499 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not automatically trust all of /opt/homebrew/bin or /usr/local/bin.
2. Retain /bin and /usr/bin as the default trusted directories.
3. Use an exact executable allowlist or verified absolute executable paths where supported.
4. Require explicit user approval before adding each non-system executable.
5. Before trusting a path, verify:
   • The resolved path is not unexpectedly redirected by a symlink.
   • The executable and parent directories have trusted ownership.
   • Group and world write permissions are disabled.
   • The executable matches an expected cryptographic hash.
6. Create a dedicated directory containing only reviewed tools instead of trusting general package-manager directories.
7. Apply separate executable policies per agent. Creator should receive only the required image-generation executable, while Engineer and Worker should receive only tools needed for a specific task.
8. Update references/troubleshooting.md so it does not recommend broad directory trust as the default fix.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:118

Finding

Telegram Bot Token Stored in Plaintext Configuration by Default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:118-126
Additional Location: scripts/telegram-topics.js:91-108
Vulnerability Type: Plaintext storage of a long-lived authentication credential
Risk Level: Low

Vulnerable Code Snippet:

text

#### Phase A: Confirm Bot Token

1. Check `openclaw.json` for `channels.telegram.botToken`
2. If present → skip to Phase B
3. If missing → guide the user:
   - "Open Telegram, search for **@BotFather**"
   - "Send `/newbot` and follow the prompts to create a bot"
   - "Copy the bot token and paste it here"
   - Write the token into `openclaw.json` at `channels.telegram.botToken`

The Telegram utility subsequently reads the plaintext token from that file:

js

function resolveToken(args) {
  if (args.token) return args.token;

  if (args.config) {
    try {
      const configPath = args.config.startsWith("~")
        ? path.join(process.env.HOME, args.config.slice(1))
        : args.config;
      const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
      const token =
        config?.channels?.telegram?.botToken ||
        config?.channels?.telegram?.credentials?.botToken;
      if (token) return token;
      console.error(
        "[ERROR] No botToken found in config at channels.telegram.botToken"
      );
      process.exit(1);
    } catch (err) {
      console.error(`[ERROR] Failed to read config: ${err.message}`);
      process.exit(1);
    }
  }

Technical Analysis

The default onboarding flow instructs the user to place a long-lived Telegram bot token directly in openclaw.json. Centralized OpenClaw secret management is mentioned only later as optional rather than being used as the default credential path.

Any local user or process that can read this configuration can recover the token. The configuration patcher also creates timestamped copies of openclaw.json, which can extend cre ...[truncated 1594 chars]

Remediation

View remediation

Remediation Suggestions

1. Make OpenClaw secret management the default onboarding path rather than an optional post-installation step.
2. Store only a secret reference in openclaw.json; do not store the token value directly.
3. Ensure credential-bearing files are created with owner-only permissions, such as 0600.
4. Modify backup logic to avoid copying plaintext secrets, or encrypt and access-control all backups.
5. Retain --config as the preferred utility interface and remove or prominently discourage --token, since command-line arguments can appear in process listings and shell history.
6. Redact token values from logs, diagnostics, dry-run output, error reports, and support bundles.
7. Add setup-time permission checks that reject configuration files readable by group or other users.
8. Document immediate token rotation through BotFather if configuration or backup exposure is suspected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (30)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

bash scripts/scaffold.sh \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 358)May include surrounding context.

md

bash scripts/scaffold.sh \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The skill contains a direct rm command targeting a local database path. Even though the path is specific and the step is labeled optional, destructive shell commands in agent-facing documentation are risky because they may be executed without validating whether the file contains data the user wants to preserve.

Content

Scanner excerpt · assets/skills/qmd-setup/SKILL.md (reported line 219)May include surrounding context.

4. (Optional) Remove the SQLite database:

   bash

   rm ~/.openclaw/memory/main.sqlite
   

After uninstalling, agents will use file-based memory (MEMORY.md + direct file reads). This works fine for small-to-medium knowledge bases and requires no additional dependencies.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase examples are broad enough to match ordinary administrative or brainstorming requests, which can cause the skill to activate when the user did not intend to install or invoke a high-impact multi-agent setup flow. In this skill, activation can scaffold workspaces, patch configuration, and alter routing behavior, so accidental invocation has meaningful side effects beyond a harmless prompt response.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The post-setup examples are open-ended operational commands like adding brands, creating posts, or updating profiles, without requiring explicit invocation boundaries, confirmation, or scoped preconditions. Because this skill manages shared memory, routing, assets, and approvals across multiple brands, broad triggers increase the chance of unintended execution, wrong-brand actions, or unauthorized modifications when a normal user request is misclassified as a skill command.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

### Step 2: Team Setup

**All 5 agents are installed automatically.** Do not ask the user to choose a team size.

The full team:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill directs execution of local shell and Node scripts that create directories, symlinks, cron jobs, and modify ~/.openclaw/openclaw.json, establishing persistent changes to the user's environment. Because the skill content provides no integrity verification, dry-run, or explicit trust boundary for those scripts, a malicious or tampered skill package could use this setup path to persist unwanted configuration or automation.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

Step 3: Run Scaffold

Execute the setup scripts to create all directories and files first:

bash

# 1. Create directories, copy templates, set up symlinks

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

### Step 4: Telegram Setup

This step uses a **guided flow** — do not ask the user for raw chat IDs or thread IDs.

#### Phase A: Confirm Bot Token

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The job message at L65 is written entirely in Traditional Chinese and directs the agent's task behavior in that language. In a config file that appears otherwise language-neutral, this imposes a specific language without any opt-in, choice, or justification, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · assets/shared/compliance-guide.md (reported line 10)May include surrounding context.

md

## [Your Market]

### Data Protection
- Don't collect personal data without consent
- Don't share customer information across brands
- Include privacy disclaimers where required
- DMs/comments containing personal data: handle, don't store

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Multiple owner-visible message templates are written entirely or partially in Traditional Chinese, including status, progress, result, and blocked-message text. The document does not indicate that this language requirement is optional, user-selected, or justified as a region-specific constraint, which creates a language/locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The uninstall instructions include deleting the SQLite database file without an explicit warning that this permanently removes indexed memory data and may disrupt recovery or rollback. While framed as optional cleanup, this is still a destructive action that an agent or user could execute mechanically, causing unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs the agent to perform web research and download reference images, but it does not disclose that network access and third-party retrieval will occur. This can expose user queries, brand plans, or browsing patterns to external services and may fetch untrusted content into the workspace without an approval step.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/workspace-creator/AGENTS.md (reported line 14)May include surrounding context.

md

1. **Read the brand** — Profile, voice, visual identity, content guidelines
2. **Quick research** — web_search for trends, competitor posts, platform context
3. **Write copy** — In the brand's content language, adapted to platform
4. **Generate visuals** — Matching product shots, lifestyle images, graphics
5. **Package** — Deliver copy + image paths + platform specs as one unit

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to write generated media and memory artifacts to local storage without any requirement for user awareness, consent, or confirmation. In an agent environment, silent file creation and persistence can surprise users, leak sensitive task context into durable notes, and expand the amount of data retained beyond what is necessary for the immediate task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to persist task-derived findings into memory/YYYY-MM-DD.md and MEMORY.md without any built-in requirement to obtain user consent, minimize content, or warn that information from a task may be retained beyond task completion. Persistent storage increases the chance that sensitive, proprietary, or regulated information from a research brief is retained and later exposed to unrelated tasks or operators.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates sending a callback containing result summaries and file paths to another session, and even provides fallback routing logic, but does not require checking data sensitivity or informing the user that task outputs will be transmitted cross-session. This creates a data-flow channel where sensitive research outcomes, internal paths, or contextual identifiers can be shared beyond the current execution context, potentially violating least-privilege and user expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The skill explicitly relies on persistent same-session context and instructs reuse of agent sessions for revisions and serial work, which can cause cross-task context bleed, stale assumptions, or inadvertent disclosure of prior task data. In a multi-agent orchestration system, session persistence increases the chance that sensitive owner or brand information is reused outside the minimum scope needed for a new task.

Content

Scanner excerpt · assets/workspace/AGENTS.md (reported line 39)May include surrounding context.

md

**Workflow principles:**
- Leader owns the content schedule — Creator receives the plan, Leader handles timing.
- All inter-agent routing goes through Leader. If Creator needs deep research (`[NEEDS_INFO]`), Leader routes to Researcher — agents never communicate directly.
- "Atomic tasks" means don't bundle cross-capability work (write copy + generate image + publish → 3 tasks). It does NOT mean micro-managing an agent's internal steps.

### Brand Scope in Briefs

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The required brief text includes Chinese ('修改完先回報') and is mandated as 'Always add', which imposes a specific language choice. This is a locale/language policy concern because the file does not offer an opt-in or alternative language selection for users or operators.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The hard-rule status template uses Chinese task text and labels such as '進行中' as the required owner-facing format. Because this is presented as mandatory and no language/locale choice is offered, it violates the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction "Owner-facing: 繁體中文 (per INSTANCE.md)" imposes a specific language for owner interactions. Under the policy, forcing a language or locale without explicit user choice or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · assets/workspace/SOUL.md (reported line 81)May include surrounding context.

md

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inline comments at L203 and L225 describe the reviewer as a "read-only agent," implying no local state should be created or modified for that agent. However, the loop still creates the reviewer workspace directory and copies SOUL.md and AGENTS.md into it at L201 and L209-L210, which are write operations. This is an active contradiction between documentation intent and code behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/telegram-topics.js (reported line 4)May include surrounding context.

js

#!/usr/bin/env node

/**
 * telegram-topics.js — Create forum topics in Telegram DM or supergroup
 *
 * Uses the Telegram Bot API `createForumTopic` to automatically create
 * forum topics. Works with both DM (thread mode enabled) and supergroups

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown workflow states that future auto-posting will execute at a scheduled time, which is a system action affecting external publication. Although the file requires explicit approval elsewhere, it does not include a direct warning to users that approved content may later be posted automatically once that capability is enabled.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/patch-config.js:116