Security audit

AI Swarm Orchestration

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent multi-agent coding orchestrator, but it grants broad unattended authority to agents and scripts that can modify, commit, push, and transmit project data with weak safety gates.

Install only in a disposable or tightly scoped project environment. Do not use it with broad shell credentials, sensitive repositories, untrusted package manifests, or direct write access to protected branches unless you first remove the approval bypasses, permission-bypass flags, automatic dependency installs, fail-open verdict logic, and automatic pushes. Treat Telegram notifications and persisted work logs as potential disclosure channels.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: scripts/notify-on-complete.sh:177
Finding: Untrusted Work Logs Can Hijack Unsandboxed Reviewer and Integrator Agents
Content: View full analysis
"$REVIEW_PROMPT_FILE" << REVIEW_PROMPT_EOF You are a code REVIEWER+FIXER at $REVIEW_PROJECT. Round $LOOP of $MAX_LOOPS. ## WORK LOG (context from the builder and previous reviewers): $WORKLOG_CONTENT --- ## YOUR TASK: ... REVIEW_PROMPT_EOF REVIEW_CMD=$("$SWARM_DIR/fallback-swap.sh" reviewer 2>/dev/null) || REVIEW_CMD="claude --model claude-sonnet-4-6 --permission-mode bypassPermissions --print" if echo "$REVIEW_CMD" | grep -q "^gemini"; then GEMINI_BASE=$(echo "$REVIEW_CMD" | sed 's/ *$//') cat > "$REVIEW_WRAPPER" << WRAPPER_EOF #!/usr/bin/env bash cd "$REVIEW_PROJECT" $GEMINI_BASE -y -p "\$(cat $REVIEW_PROMPT_FILE)" WRAPPER_EOF else cat > "$REVIEW_WRAPPER" << WRAPPER_EOF #!/usr/bin/env bash cd "$REVIEW_PROJECT" $REVIEW_CMD "\$(cat $REVIEW_PROMPT_FILE)" WRAPPER_EOF fi ``` ```bash # scripts/integration-watcher.sh COMBINED_LOGS="" for sess in "${SESSIONS[@]}"; do SUBLOG="/tmp/worklog-${sess}.md" if [[ -f "$SUBLOG" ]]; then COMBINED_LOGS="$COMBINED_LOGS ======================================== ## Subteam: $sess ======================================== $(cat "$SUBLOG")" fi done INTEG_LOG_CONTENT=$(cat "$INTEGRATION_LOG") cat > "$INTEG_PROMPT_FILE" << INTEG_PROMPT_EOF You are an INTEGRATION REVIEWER at $PROJECT_DIR. Round $LOOP of $MAX_REVIEW_LOOPS. ## CONTEXT — All Subteam Work Logs: $INTEG_LOG_CONTENT ... INTEG_PROMPT_EOF INTEG_CMD=$("$SWARM_DIR/fallback-swap.sh" integrator 2>/dev/null) || INTEG_CMD="claude --model claude-opus-4-6 --permission-mode bypassPermissions --print" ``` # ...[truncated 1826 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/spawn-batch.sh:83
Finding: Batch Spawning Silently Fabricates Human Endorsement
Content: View full analysis
/dev/null fi if [[ -n "$MODEL" ]]; then "$SPAWN_AGENT" "$PROJECT_DIR" "$TASK_ID" "$DESCRIPTION" "$AGENT" "$MODEL" "$REASONING" else "$SPAWN_AGENT" "$PROJECT_DIR" "$TASK_ID" "$DESCRIPTION" "$AGENT" "" "$REASONING" fi done ``` ### Technical Analysis The declared workflow requires the orchestrator to present a plan, stop, and wait for explicit human approval. `spawn-agent.sh` checks for an endorsement file, but `spawn-batch.sh` automatically creates that file whenever it is absent. The component that consumes the approval is therefore also allowed to fabricate it. A tasks JSON file or invocation of `spawn-batch.sh` becomes equivalent to authenticated human consent, even though no human action is verified. ### Attack Path 1. An agent or local process creates a valid tasks JSON file. 2. It invokes `spawn-batch.sh` without obtaining human approval. 3. The script automatically calls `endorse-task.sh` for every task. 4. `spawn-agent.sh` sees the fabricated endorsement files and accepts the tasks. 5. Agents start with broad shell, dependency-installation, Git, and network capabilities. 6. Review and integration watchers continue the workflow automatically. ### Impact Assessment This bypass permits unauthorized external AI requests, local command execution by spawned agents, package installation, project modification, Git commits, remote pushes, and automatic integration. It directly violates the Skill’s stated trust boundary and least ...[truncated 23 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/spawn-agent.sh:229
Finding: Agent Approval and Sandbox Protections Are Deliberately Disabled
Content: View full analysis
"$RUNNER_SCRIPT" << RUNNER_EOF #!/bin/bash cd "$WORK_DIR" PROMPT=\$(cat "$PROMPT_FILE") case "$AGENT" in codex) codex --model $MODEL -c "model_reasoning_effort=$REASONING" --full-auto "\$PROMPT" ;; claude) claude --model $MODEL --permission-mode bypassPermissions --print "\$PROMPT" ;; gemini) GEMINI_API_KEY="${GEMINI_API_KEY:-}" gemini --model $MODEL -p "\$PROMPT" ;; esac RUNNER_EOF ``` The accompanying tool guidance also recommends: ```text Claude | claude --model X --dangerously-skip-permissions -p "prompt" Codex | codex --model X --dangerously-bypass-approvals-and-sandbox "prompt" Gemini | GEMINI_API_KEY=$KEY gemini --model X -p "prompt" ``` ### Technical Analysis The Skill deliberately disables permission checks or enables fully autonomous operation for coding agents that process task prompts and untrusted repository content. This is not the minimum privilege required to orchestrate multiple agents. `spawn-agent.sh` also sources `$HOME/.bashrc` before execution, making the user’s configured environment and potentially sensitive environment variables available to these unrestricted agent processes. Because these agents can invoke shell commands, edit files, install packages, commit, and push, bypassing approval and sandbox boundaries greatly increases the consequences of prompt injection, malicious repository instructions, or model errors. ### Attack Path 1. A task prompt or repository file contains malicious or misleading instructions. 2. The agent processes that content while running in full-auto or permission-bypass mode. 3. The agent invokes tools without a human approval checkpoint. 4. It reads files outside the intended worktree, executes local commands, modifies the ...[truncated 436 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/spawn-agent.sh:207
Finding: Target Repository Dependency Scripts Execute Automatically
Content: View full analysis
/dev/null || true elif [[ -f "yarn.lock" ]]; then yarn install 2>/dev/null || true elif [[ -f "package-lock.json" ]]; then npm install 2>/dev/null || true fi fi ``` ### Technical Analysis The script automatically runs a package manager merely because a project contains `package.json` and a recognized lockfile. npm-compatible package managers execute dependency lifecycle hooks by default, including `preinstall`, `install`, and `postinstall`. Consequently, selecting a malicious or compromised repository as the project can trigger arbitrary local code execution before the coding agent even begins. Error suppression and `|| true` further obscure failures or suspicious behavior. ### Attack Path 1. An attacker provides or compromises a repository containing a malicious package lifecycle script or dependency. 2. The repository includes a supported lockfile. 3. A user invokes `spawn-agent.sh` or `spawn-batch.sh` against the repository. 4. The script automatically executes `npm install`, `yarn install`, or `pnpm install`. 5. The malicious lifecycle script runs with the privileges and environment of the user. 6. The payload can access local files, credentials, source code, or create persistence outside the project. ### Impact Assessment This can yield arbitrary command execution under the invoking user account. The scope may include credential theft, source-code compromise, modification of other repositories, network exfiltration, and installation of persistence mechanisms. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/notify-on-complete.sh:286
Finding: Missing Review Verdicts Are Treated as Success and Changes Are Pushed Automatically
Content: View full analysis
/dev/null | head -1) WORKLOG_UPDATED=false if [[ -f "$WORKLOG" ]] && grep -q "Review.*Round $LOOP\|review.*round $LOOP\|Round $LOOP" "$WORKLOG" 2>/dev/null; then WORKLOG_UPDATED=true fi if echo "$LATEST_MSG" | grep -qi "review\|fix\|pass\|clean"; then SUMMARY="Review passed — reviewer fixed issues (commit: $LATEST_MSG)" PASS="True" elif [[ "$WORKLOG_UPDATED" == "true" ]]; then SUMMARY="Review passed — reviewer found no issues (work log updated, no fixes needed)" PASS="True" else SUMMARY="Review passed — reviewer exited cleanly (auto-pass: clean exit, no issues indicated)" PASS="True" fi break fi ``` ```bash # scripts/integration-watcher.sh if [[ ! -f "$VERDICT_FILE" ]]; then LATEST_MSG=$(cd "$PROJECT_DIR" && git log --oneline -1 2>/dev/null | head -1) INTEG_LOG_UPDATED=false if [[ -f "$INTEGRATION_LOG" ]] && grep -q "Integration Round $LOOP\|integration.*round $LOOP" "$INTEGRATION_LOG" 2>/dev/null; then INTEG_LOG_UPDATED=true fi if echo "$LATEST_MSG" | grep -qi "integration\|review\|fix\|pass\|clean"; then PASS="True" elif [[ "$INTEG_LOG_UPDATED" == "true" ]]; then PASS="True" else PASS="True" fi break fi ``` ```bash cd "$PROJECT_DIR" git add docs/history/ docs/ESR.md 2>/dev/null || true git commit -m "docs: auto-update ESR + persist integration history ($(date +%Y-%m-%d))" 2>/dev/null || true git push origin main 2>/dev/null || git push 2>/dev/null || true ``` ### Technical Analysis A verdict file is documented as mandatory, but its absence is interpreted as a passing result. A reviewer crash, ...[truncated 1090 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/endorse-task.sh:9
Finding: Unsanitized Task Input Enables Path Traversal and Python Source Injection
Content: View full analysis
[endorsement-note]}" NOTE="${2:-Endorsed}" ENDORSE_DIR="$SWARM_DIR/endorsements" ENDORSE_FILE="$ENDORSE_DIR/${TASK_ID}.endorsed" mkdir -p "$ENDORSE_DIR" cat > "$ENDORSE_FILE" << EOF Task: $TASK_ID Endorsed: $(date '+%Y-%m-%d %H:%M:%S') Note: $NOTE EOF ``` ```bash # scripts/spawn-agent.sh python3 -c " import json task = { 'id': '$TASK_ID', 'tmuxSession': '$TMUX_SESSION', 'agent': '$AGENT', 'model': '$MODEL', 'description': '''$DESCRIPTION'''[:200], 'project': '$PROJECT_NAME', 'projectDir': '$PROJECT_DIR', 'worktree': '$WORK_DIR', 'branch': '$BRANCH', 'startedAt': $TIMESTAMP, 'status': 'running', 'retries': 0, 'notifyOnComplete': True } with open('$TASKS_FILE') as f: data = json.load(f) data['tasks'].append(task) with open('$TASKS_FILE', 'w') as f: json.dump(data, f, indent=2) " ``` ```python # scripts/spawn-batch.sh tid=t.get('id','').strip() desc=t.get('description','').strip() agent=(t.get('agent') or 'claude').strip() model=(t.get('model') or '').strip() reasoning=(t.get('reasoning') or 'high').strip() print('\t'.join([tid,desc,agent,model,reasoning])) ``` ### Technical Analysis Task IDs are used directly as path components, branch names, tmux session names, and log names without an allowlist. A value containing `../` can escape the endorsement directory and cause writes to unintended locations. Task IDs, descriptions, model names, agent names, and project paths are also interpolated directly into Python source passed to `python3 -c`. Quote characters or Python syntax can terminate the intended string literal and inject new Python statements. Parsing the tasks JSON doe ...[truncated 1044 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fallback-swap.sh:22
Finding: Configuration-Controlled Command Strings Are Embedded Into Shell Wrappers
Content: View full analysis
/dev/null } IFS='|' read -r P_AGENT P_MODEL P_CMD <<< "$(read_role primary)" ... echo "$P_CMD" ``` ```bash # scripts/notify-on-complete.sh REVIEW_CMD=$("$SWARM_DIR/fallback-swap.sh" reviewer 2>/dev/null) || REVIEW_CMD="claude --model claude-sonnet-4-6 --permission-mode bypassPermissions --print" cat > "$REVIEW_WRAPPER" << WRAPPER_EOF #!/usr/bin/env bash cd "$REVIEW_PROJECT" $REVIEW_CMD "\$(cat $REVIEW_PROMPT_FILE)" WRAPPER_EOF chmod +x "$REVIEW_WRAPPER" tmux new-session -d -s "$REVIEW_SESSION" -c "$REVIEW_PROJECT" "bash $REVIEW_WRAPPER" ``` ```bash # scripts/integration-watcher.sh INTEG_CMD=$("$SWARM_DIR/fallback-swap.sh" integrator 2>/dev/null) || INTEG_CMD="claude --model claude-opus-4-6 --permission-mode bypassPermissions --print" cat > "$INTEG_WRAPPER" << IWRAP_EOF #!/usr/bin/env bash cd "$PROJECT_DIR" $INTEG_CMD "\$(cat $INTEG_PROMPT_FILE)" IWRAP_EOF ``` ### Technical Analysis `nonInteractiveCmd` is a free-form command string read from `duty-table.json`. The string is returned by `fallback-swap.sh` and inserted without safe argument handling into a generated shell script. If the duty table is modified, replaced, or synchronized from an untrusted `ROUTER_DUTY` source, shell operators such as semicolons, command substitutions, redirections, or pipelines become executable code when the reviewer or integration wrapper starts. The design tr ...[truncated 787 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about orchestrating multiple coding agents and managing parallel software development workflows. The supplied code does not perform any of those core functions. Instead, it is a standalone support script for sending backup completion notifications from a pending-notifications file via openclaw, likely to Telegram or another channel. While notifications are mentioned in the description, this code chunk’s actual primary purpose is notification dispatch/retry under cron, not multi-agent orchestration. That makes the description materially inaccurate for this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk does not implement swarm orchestration behavior. Its primary purpose is maintaining an executive EOR markdown log for a project and optionally syncing that file to an Obsidian directory. This is materially different from the declared description of parallel AI agent orchestration with tmux, git worktrees, code review/integration, and Telegram notifications. While logging could be a supporting feature within a larger orchestrator, this chunk itself is specifically a documentation/logging utility with filesystem write/copy behavior not reflected in the declared purpose, so this code-description pairing should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about orchestrating parallel AI coding agents and related workflow automation. The supplied code chunk does not implement any of that. Its sole purpose is documentation/log maintenance: it initializes or updates docs/ESR.md, migrates old EOR files to ESR, updates timestamps, appends summary text, and optionally copies the file into an Obsidian directory. This is a materially different primary purpose and includes file-management/sync behavior not reflected in the declared description.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/assess-models.sh (reported line 151)May include surrounding context.
sh
fi rm -f "$result_file" 2>/dev/null [[ -n "$tmpdir" ]] && rm -rf "$tmpdir" 2>/dev/null || true } PROBE="Reply with ONLY the word HELLO, nothing else."

Prompt Exfiltration via Tool

High

Category: System Prompt Leakage
Confidence: 88% confidence
Finding: The full prompt is written to a log file under the swarm logs directory before execution, which can persist sensitive task instructions, repository details, tokens pasted into prompts, or other confidential context. In a multi-agent coding workflow, prompts may include proprietary code guidance or secrets, so storing them as plaintext creates an avoidable exfiltration and disclosure surface.
Content: Scanner excerpt · scripts/spawn-agent.sh (reported line 219)May include surrounding context.
sh
fi fi # Write prompt to a file to avoid shell expansion issues with special chars PROMPT_FILE="$SWARM_DIR/logs/${TMUX_SESSION}-prompt.md" printf '%s' "$PROMPT" > "$PROMPT_FILE"

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · scripts/spawn-agent.sh (reported line 235)May include surrounding context.
sh
codex --model $MODEL -c "model_reasoning_effort=$REASONING" --full-auto "\$PROMPT" ;; claude) claude --model $MODEL --permission-mode bypassPermissions --print "\$PROMPT" ;; gemini) GEMINI_API_KEY="${GEMINI_API_KEY:-}" gemini --model $MODEL -p "\$PROMPT"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes operations that require broad file, shell, and network capabilities, but it does not declare any explicit tool scope or permission boundaries. In a skill that can spawn shell scripts, manipulate repositories, and send Telegram messages, missing scope makes it easier for the runtime or user to invoke the skill with excessive privileges and without clear consent boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mentions Telegram bot token use and notifications, but it does not clearly warn that task metadata, completion details, or repository-related information may be transmitted to an external service. In a multi-agent coding workflow, those notifications can leak sensitive project names, branch names, task descriptions, or operational status outside the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises automatic integration, merging, and even conflict resolution, but it does not prominently warn users that repository state may be changed without a final human review checkpoint. In a coding orchestration context, silent or poorly disclosed auto-merge behavior can overwrite work, introduce malicious code from spawned agents, or corrupt branches at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The role definition explicitly states 'Auto-merge to main' as part of the default workflow without any warning, gating, or mandatory human confirmation at the point of merge. In a multi-agent coding orchestration skill, this is dangerous because autonomous or semi-autonomous agents may integrate unreviewed, incorrect, or malicious changes directly into the primary branch, amplifying mistakes across the project.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation explicitly instructs operators to run agent CLIs with flags that disable permissions, approvals, or sandbox protections in fully non-interactive mode. In the context of a multi-agent coding swarm that spawns parallel coding agents over project worktrees, this materially increases the chance that prompt-driven or compromised agent behavior can execute unsafe actions, modify code, access sensitive data, or perform destructive operations without human review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file assigns Codex as the active builder even though the same metadata marks Codex as benched and its model as unsupported with a model-error state. In an orchestration skill that spawns autonomous coding agents, this inconsistency can cause the system to invoke the wrong tool, fail open to fallback behavior, or bypass intended operational safety gates around which agents are allowed to run.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This shell script creates and appends to assessment.log, and later captures command output from multiple agent CLIs into that workflow. Although the file header mentions that the script updates duty-table.json, it does not similarly disclose to the user that it persistently logs assessment activity and CLI results to assessment.log.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script may send outbound messages via openclaw message send when SWARM_NOTIFY_TARGET is configured, which is a network action that transmits assessment status externally. This behavior is not disclosed in the usage text or visible startup messaging, so users may not realize that running the script can trigger notifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script invokes another shell script via bash and later writes updates to active-tasks.json and pending-notifications.txt, but it provides no upfront comment, confirmation, or clear user-facing disclosure that it will execute external commands and modify local files. The existing status prints only appear after actions occur and do not meaningfully warn users about these side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script reads arbitrary pending notification text and sends it to an external channel (Telegram by default) without any validation, minimization, or explicit disclosure at the point of transmission. In the context of an AI swarm orchestration tool, task names, branch names, file paths, or generated summaries may contain sensitive project metadata, so this creates a real risk of unintended data exfiltration if users enable notifications without understanding what content is being sent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script retrieves usage data via openclaw status --usage --json and later may transmit rotation details through openclaw message send. While there is some internal logging and a conditional target check, there is no explicit user disclosure in comments or prompts that operational/account usage state may be collected and sent to an external notification channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script automatically rewrites duty-table.json and changes the primary/fallback model assignment as soon as a fallback test succeeds, with no user approval, locking, or change-validation step. In this skill’s context, that behavior affects agent/model selection for a multi-agent coding orchestration system, so an erroneous failure signal, transient outage, or manipulated config could silently alter future execution paths and reduce operator control.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script comments and behavior establish a design pattern of collecting, reading, and persisting all subteam work logs for orchestrator traceability. In this skill, that broad retention and reuse of agent logs expands exposure of potentially sensitive implementation details and encourages indiscriminate sharing of data across components and over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script explicitly collects all subteam work logs and persists them into the project history for later orchestrator access. Because work logs may contain code snippets, secrets, prompts, review notes, or internal architecture details, this creates durable storage of sensitive information beyond the original ephemeral execution context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends integration status and summaries to an external messaging target via openclaw message send, and on failure queues the same content to a local file. In this skill, those messages can include project names, review summaries, and potentially sensitive development context without any consent gate, redaction, or destination validation, creating a real data exfiltration channel.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The integration reviewer is instructed to read all subteam work logs and use their contents as downstream model context, then update persistent logs. In a multi-agent coding system, work logs can contain secrets, proprietary code, credentials, or prior prompt content, so aggregating and forwarding them to another model materially increases the scope of disclosure and the blast radius of any sensitive data leak.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script performs unattended git commit and git push operations after AI-driven review/fix loops and again when persisting history. In this skill context, where multiple agents modify code in parallel and an integration agent may auto-fix issues, automatic pushes can publish unsafe, incorrect, or sensitive changes to shared remotes without human approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script automatically stages, commits, and pushes changes in the reviewed project without any user confirmation. In this skill's context, where autonomous agents can edit code and logs, this can publish unintended, unsafe, or attacker-influenced modifications directly to a remote repository, amplifying the impact of any prompt injection or reviewer error.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.