Agent Swarm - 多智能体集群编排

• Outcome: Review
• Latest audit: May 29, 2026, 9:22 PM
• Version:
  1.0.0

Overview

This is a coherent multi-agent orchestration skill, but it deserves Review because it enables command execution, browser automation, scheduled jobs, broad file changes, and persistent prompt memory without strong guardrails.

Install only if you want agents that can write files, run commands, automate a browser, and create scheduled jobs. Before use, review the OpenClaw config, disable cron/browser/exec for agents that do not need them, require exact command and cron previews before execution, keep credentials out of experience memory, and avoid using untrusted agent IDs or base paths with the helper scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The guide grants the automator agent high-risk capabilities including exec, process, cron, and browser, even though the skill is described primarily as multi-agent task decomposition and orchestration. Combining scheduled execution with code execution and browser access increases the attack surface and enables persistence, unattended actions, or abuse if the automator receives unsafe prompts or is compromised.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The setup guide instructs users to place raw API keys directly into a JSON configuration example, which encourages insecure secret handling for a skill whose purpose is orchestration rather than credential management. This can lead users to store secrets in plaintext files that may be copied, logged, or checked into version control.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The tool provisions agent templates with broad capabilities such as write access by default, network access for the researcher template, and exec/process permissions for the coder template. In a multi-agent orchestration skill, creating subordinate agents with powerful filesystem and execution privileges expands the attack surface and can enable prompt-injection-driven file tampering, data exfiltration, or arbitrary command execution if these agents are later invoked on untrusted tasks.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script constructs write paths from user-controlled `--base-path` and `agent_id` without constraining them to an approved root or validating path traversal sequences. In a multi-agent environment, this allows a caller to create or overwrite files outside the intended agent memory area, which can tamper with other agent state or clobber arbitrary writable files on the host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document advertises agents that can write files, execute commands, and set cron jobs, but it does not prominently warn users about these state-changing and persistent actions. In practice, this can lead to silent system modification, scheduled task persistence, or unsafe execution initiated under a broad orchestration umbrella.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The experience injection mechanism reuses stored historical content by inserting it into future prompts without any warning about privacy, integrity, or cross-task contamination risks. If prior memory contains secrets, user-specific data, or adversarial text, it can be propagated into later tasks and influence downstream agents unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document shows an API key field populated as a direct configuration value without any caution about secure storage, exposure, or rotation. This is dangerous because users commonly copy such examples verbatim, leading to plaintext credential storage and potential compromise of paid model endpoints or connected services.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The permanent deletion branch calls shutil.rmtree(agent_path) directly when --no-backup is supplied, with no interactive confirmation, dry-run, or additional safeguard. Because agent_id and base_path are user-controlled, operator mistakes or unsafe automation can irreversibly delete agent data, making accidental destructive actions more likely in an orchestration environment managing multiple agent workspaces.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The tool stores arbitrary free-form `experience` text and later emits it verbatim through `inject_experiences()` for insertion into prompts. In an agent-swarm skill, that memory becomes cross-task prompt input, so a user can plant prompt-injection instructions, secrets, or misleading guidance that persists and influences future agent behavior or leaks prior sensitive content.

VirusTotal

65/65 vendors flagged this skill as clean.