Team Lead

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it needs Review because it can automatically delegate work to spawned agents and keeps or logs user task content without clear limits.

Install only if you are comfortable with a skill that can coordinate multiple agents, spawn or target sessions, and pass task context to them. Avoid giving it secrets, credentials, private documents, or regulated data unless you have reviewed the logging/history behavior and know where OpenClaw session logs and exported histories go. Expect Chinese-language prompts and output unless you customize the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The code is related to a multi-agent system, but its actual role is narrower than the declared description. It does not orchestrate execution of complex tasks; instead it maintains metadata about agents and their performance. The implemented behaviors are registry management, capability matching, health calculation, ranking, and persistence import/export. Those support orchestration, but they do not themselves decompose tasks, dispatch tasks, collect outputs, or ensure final result quality in the sense described. Therefore the declared purpose materially overstates the functionality of this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The code aligns partially with the declared orchestration/dispatch role: it finds candidate agents, selects the best one, can create a new agent configuration when none match, tracks execution, and supports batch dispatch with dependency ordering. However, key parts of the declared purpose are missing or only weakly implied. There is no logic to decompose complex tasks into subtasks, no true aggregation/synthesis of multiple agent outputs into a unified final result, and no real quality control beyond recording a quality field if returned. The primary implemented purpose is dispatch and tracking rather than full multi-agent orchestration lead functionality as described. Additionally, dynamic agent spawning/registration is an implemented capability not explicitly reflected in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a broad multi-agent orchestration component responsible for decomposing tasks, dispatching them to agents, aggregating outputs, and ensuring quality. The supplied code only covers the quality-assurance portion: it checks textual outputs against heuristics, computes weighted scores, stores check history, and returns feedback/statistics. It does not decompose tasks, invoke or coordinate agents, route work, or aggregate multi-agent outputs in the orchestration sense. While quality checking is one subset of the declared description ('ensure quality'), the primary implemented purpose is materially narrower and different from the claimed orchestration lead role, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a full multi-agent orchestration lead responsible for decomposing tasks, assigning them to specialized agents, aggregating outputs, and ensuring quality. The supplied code chunk is narrowly a ResultAggregator class. Its functions are confined to combining already-produced results using strategies like merge, select-best, consensus, and chain; scoring results; detecting simple textual/number/date conflicts; and formatting output. These behaviors align with only the aggregation portion of the declared purpose. There is no code for breaking down tasks, invoking or dispatching agents, managing agent lifecycle, or coordinating execution. Therefore the description materially overstates the skill’s primary behavior, making this a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The implementation matches part of the description: it decomposes tasks and prepares orchestration metadata such as suggested agent types, dependencies, parallelization, and execution plans. However, the declared purpose presents a broader 'orchestration lead' that also dispatches to specialized agents, aggregates results, and ensures quality. None of those latter capabilities are implemented in this code chunk. Instead, this module is specifically a task decomposer/planner. Therefore the description overstates the code's actual behavior in material ways.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The README is written primarily in Chinese and presents the skill behavior, examples, and operational guidance in that language without documenting language selection or fallback behavior for users in other locales. While not directly enabling code execution, this can create safety and usability risk because users may misunderstand orchestration scope, warnings, or review expectations, especially for a skill coordinating multiple agents across sensitive tasks.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README describes the skill as a general-purpose orchestration lead for research, coding, content creation, design, and learning tasks, with no clear trigger boundaries, authorization constraints, or limits on when it should delegate to other agents. In a multi-agent environment, this broad activation scope can cause overreach, unnecessary delegation, or unsafe execution of sensitive tasks because the skill may be invoked for almost any complex request.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The title and core operating instructions are in Chinese and instruct the agent role in that language, but the document does not state that language selection is optional or configurable. This can amount to a language/locale policy issue because the skill appears to assume a default language without explicit user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing natural language exclusively in Chinese, including headings, instructions, evaluations, and release guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The systemPrompt values for multiple dynamic agent templates are written entirely in Chinese, which imposes a specific language on agent behavior. In a general default-agents configuration, this is a natural-language locale constraint without any visible opt-in, user choice, or region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file’s natural-language instructions, workflow descriptions, and examples are all written in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy criterion, forcing a specific language without user choice is a policy concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The dispatcher logs the generated instruction string, which is built from untrusted subtask input and serialized context. In a multi-agent orchestration component, those fields may contain sensitive user data, credentials, internal prompts, or proprietary context, and writing even truncated instruction content to logs can expose that data to operators, log processors, or downstream systems.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The constructed agent instruction is entirely in Chinese, directing downstream agents in a specific language regardless of user preference. This is a language/locale policy issue because the file does not offer a language choice or document a justified region-specific constraint.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: All dynamic agent `systemPrompt` values are written in Chinese and implicitly require Chinese-language operation. The file provides no opt-in, fallback, or justification for enforcing that locale, so the behavior conflicts with the language-choice policy.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code logs user-supplied task content directly with console.log, which can disclose sensitive input into application logs, terminals, hosted logging backends, or support artifacts. Because this component orchestrates arbitrary complex tasks, users may paste secrets, internal documents, or regulated data, making raw prompt logging a real confidentiality risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code stores the full original task and context in task history and active task records, which may contain sensitive user prompts, credentials, proprietary data, or personal information. In a multi-agent orchestration skill, retaining raw task content increases exposure through memory inspection, debugging, later export, or accidental secondary use without any minimization, redaction, or retention controls.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This JavaScript file presents its top-level description and operational comments in Chinese, and the generated feedback/suggestions returned to users are also hard-coded in Chinese. The skill does not offer any user opt-in or locale selection, which creates a language-policy concern for users expecting another language.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file contains natural-language descriptions and output strings in Chinese, including the class header and later user-facing report text, but there is no indication that the user can opt into another language or that the skill is intentionally region-specific. This can violate language/locale policy because it effectively forces a specific language for users of the skill.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: All report headings, labels, and explanations produced by formatAsMarkdown are hard-coded in Chinese, and the timestamp is also localized via toLocaleString without any user-controlled locale setting. Because these are the main user-visible outputs, the skill imposes a specific language/locale without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The primary skill description is written as a Chinese-only behavioral statement ('将复杂任务拆解为可分配的子任务'), and the file consistently uses Chinese labels and instructions throughout its natural-language strings. There is no indication that users can choose another language or that the locale restriction is intentional and justified, which creates a language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This markdown file presents core user-facing content in Chinese while embedding key command/context labels in English, but it does not state that the skill is intended specifically for Chinese-speaking users or offer any language choice. That can conflict with a language/locale policy requiring user opt-in or clear justification for a forced locale.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The predefined agent capabilities are primarily expressed in Chinese string literals, with only a few English terms mixed in. For a general-purpose registry, this can create an implicit language preference that is not documented as optional or region-specific, which fits the policy concern about forcing a locale without explicit opt-in.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The file's natural-language descriptions and comments are predominantly Chinese, including the class and method descriptions, with no indication that language is selectable or intentionally region-scoped. This can constitute a language/locale policy issue when a skill effectively assumes one language without opt-in or documented justification.

Static analysis

No suspicious patterns detected.