Multi Team Coding

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI coding automation workflow, but it gives agents broad unattended control over issues, commits, PRs, merges, and cleanup without enough user gates.

Install only if you are comfortable with unattended agents reading open GitHub issues, editing your repository, committing, pushing, opening PRs, and potentially merging them. Use a test repository or fork first, require human review before any push or merge, restrict GitHub tokens, pin dependencies, ignore Playwright auth state files, and remove or rewrite destructive cleanup commands before running the scripts on valuable work.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: examples/one-person-company.sh:126

Finding

Untrusted GitHub issue content controls autonomous coding agents

Content

View full analysis

$WORKSPACE_BASE/logs/issue-${issue_num}.log 2>&1 & ``` ```bash # examples/one-person-company.sh:126-166 # 获取 issue 详细信息 local issue_body=$(gh issue view $issue_num --json body -q .body) # 构建提示词 local prompt=" 【Issue #$issue_num】: $title 【类型】: $task_type 【详情】: $issue_body 【要求】: 1. 仔细阅读 issue 描述，理解需求 2. 定位相关代码文件 3. 实现修复/功能（遵循项目规范） 4. 编写/更新测试（确保覆盖率） 5. 运行测试确保通过 6. 提交代码（格式: $task_type(#$issue_num): 简短描述） 【完成后执行】: git add . git commit -m '$task_type(#$issue_num): $title' git push -u origin $branch_name gh pr create --title '$task_type: $title' --body 'Closes #$issue_num' --head $branch_name openclaw system event --text '✅ #$issue_num 完成并创建 PR' --mode now " # 启动 agent case $agent in claude) bash pty:true workdir:$work_dir background:true \ command:"claude '$prompt'" \ > $WORKSPACE_BASE/logs/issue-${issue_num}.log 2>&1 ;; codex) bash pty:true workdir:$work_dir background:true \ command:"codex exec --full-auto '$prompt'" \ > $WORKSPACE_BASE/logs/issue-${issue_num}.log 2>&1 ;; opencode) bash pty:true workdir:$work_ ...[truncated 2680 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: examples/one-person-company.sh:225

Finding

AI-generated pull requests are merged automatically after an incomplete CI check

Content

View full analysis

$WORKSPACE_BASE/prs.json local pr_count=$(jq length $WORKSPACE_BASE/prs.json) echo " 发现 $pr_count 个待处理 PR" if [ $pr_count -eq 0 ]; then echo " ✅ 没有待处理的 PR" return fi # 批量审查 jq -r '.[] | "\(.number):\(.headRefName)"' $WORKSPACE_BASE/prs.json | while IFS=: read -r pr_num branch; do echo "" echo " 审查 PR #$pr_num..." # 检查 CI 状态 local ci_status=$(gh pr view $pr_num --json statusCheckRollup -q '.statusCheckRollup[0].state') if [ "$ci_status" = "SUCCESS" ]; then echo " ✅ CI 通过" # 自动合并 if gh pr merge $pr_num --squash --delete-branch; then echo " ✅ PR #$pr_num 已合并" # 清理 worktree local work_dir="$WORKSPACE_BASE/teams/$(echo $branch | sed 's/^issue-/issue-/')" if [ -d "$work_dir" ]; then git worktree remove $work_dir 2>/dev/null || true fi else echo " ⚠️ PR #$pr_num 合并失败" fi else echo " ⏳ CI 未通过，等待中..." fi done } ``` ### Technical Analysis The function describes itself as performing automatic review, but it does not inspect the diff, require reviewer approval, verify provenance, or run a security policy. It only reads `.statusCheckRollup[0].state`, which checks the first status entry rather than confirming that every required check succeeded. The selected PR set is also broad: every open PR authored by the authenticated user is considered, rather than only PRs created during the current workflow and recorded in a trusted manifest. Consequently, an unrelated user-authored PR may be merged as well. CI success is not equiv ...[truncated 1266 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: examples/playwright-test-workflow.sh:23

Finding

Unpinned package installation permits supply-chain code execution

Content

View full analysis

/dev/null; then echo " 📦 安装 Playwright..." npm install -D @playwright/test npx playwright install fi ``` ```bash # SKILL.md:313-320 # 安装依赖 if [ -f "package.json" ]; then npm install elif [ -f "requirements.txt" ]; then pip install -r requirements.txt fi ``` ```bash # SKILL.md:844-845 npm install npm test ``` ### Technical Analysis The workflow installs `@playwright/test` without pinning an exact version and uses `npm install` for project dependencies rather than requiring a reviewed lockfile and reproducible installation. Package installation can run lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Because autonomous agents can modify dependency manifests before validation, this behavior creates a particularly dangerous chain: untrusted issue content can cause an agent to add a package or lifecycle script, after which the validation step executes it. The Python installation path similarly trusts every package and source declared in `requirements.txt`, including mutable versions, direct URLs, and potentially unsafe package indexes. ### Attack Path 1. A malicious registry release is published, or an attacker causes an agent to add a malicious dependency or lifecycle script. 2. The workflow runs `npm install`, `npm install -D @playwright/test`, or `pip install -r requirements.txt`. 3. The package manager resolves and downloads mutable external content. 4. Installation or build hooks execute with the workflow user’s permissions. 5. The malicious package reads local data, modifies th ...[truncated 580 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:844

Finding

Destructive Git cleanup can irreversibly delete legitimate work

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: PLAYWRIGHT-AUTOMATION.md:153

Finding

Reusable authenticated browser state is stored without required protections

Content

View full analysis

{ await page.goto("/login"); await page.fill("input[name=email]", process.env.TEST_USER_EMAIL); await page.fill("input[name=password]", process.env.TEST_USER_PASSWORD); await page.click("button[type=submit]"); await page.waitForURL("/dashboard"); await page.context().storageState({ path: authFile }); }); ``` ```typescript export default defineConfig({ projects: [ { name: "setup", testMatch: /.*\.setup\.ts/ }, { name: "chromium", use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/user.json", }, dependencies: ["setup"], }, ], }); ``` ### Technical Analysis Playwright storage-state files may contain authenticated cookies, local-storage values, and other bearer tokens. Anyone who obtains the file may be able to impersonate the test user until those credentials expire or are revoked. The guide instructs users to write this state beneath the project directory but does not require a `.gitignore` entry, restrictive filesystem permissions, secure artifact exclusions, encryption, or cleanup after testing. The broader workflow also performs `git add .` in generated-agent prompts, increasing the possibility that the authentication file could be committed accidentally. ### Attack Path 1. The authentication setup logs in using `TEST_USER_EMAIL` and `TEST_USER_PASSWORD`. 2. Playwright writes reusable authenticated state to `playwright/.auth/user.json`. 3. The file remains in the project directory. 4. A broad Git staging command, CI artifact upload, backup, or another local process obtains the file. 5. An attacker imports ...[truncated 686 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (64)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documented 'git worktree remove /tmp/issue-123' performs a destructive local removal and is presented without validation or warning. While less severe than arbitrary rm -rf, it can still delete the wrong worktree or discard unmerged local state if the path is mistaken or generated incorrectly by surrounding automation.

Content

Scanner excerpt · ONE-PERSON-COMPANY.md (reported line 102)May include surrounding context.

gh pr merge --squash --delete-branch

清理 worktree

git worktree remove /tmp/issue-123

text

### 5. 日报生成

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The command 'rm -rf $WORKSPACE_BASE/teams/*' is dangerous because it recursively deletes whatever path expands from a variable without validation. If WORKSPACE_BASE is empty, malformed, attacker-influenced, or unexpectedly points elsewhere, the cleanup step could erase unrelated files or large portions of the filesystem.

Content

Scanner excerpt · ONE-PERSON-COMPANY.md (reported line 272)May include surrounding context.

tar -czf logs-$(date +%Y%m%d).tar.gz $WORKSPACE_BASE/logs/

清理临时文件

rm -rf $WORKSPACE_BASE/teams/* }

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Using 'git push --force' in an automated workflow is risky because it rewrites remote branch history and can overwrite collaborators' work or erase forensic context. In a multi-agent system producing many changes quickly, force-push magnifies the chance of accidental loss and makes malicious or faulty modifications harder to audit.

Content

Scanner excerpt · ONE-PERSON-COMPANY.md (reported line 331)May include surrounding context.

cd $WORKSPACE_BASE/teams/issue-123

修复问题

git commit --amend git push --force

text

## 成本分析

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

该描述明显宽于代码实际行为。代码核心目的不是完整的多代理编程与 PR 自动化平台，而是一个 Playwright 测试工作流脚本。它确实涉及一定的“团队/并行”概念，但范围仅限测试生成任务，并没有实现描述中提到的 OpenClaw、Codex、OpenCode 协作开发，也没有 PR 管理/合并或高频提交工作流。虽然脚本中为 performance 测试定义了提示模板分支，但默认批量生成逻辑只启动 e2e、api、visual 三类测试，因此连声明中的 Playwright 全套能力也未完整落地。综上，描述与实际代码存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

git reset --hard HEAD~1 is a destructive command that discards working tree and index changes while rewriting the current branch position. In this skill, it is presented as an automatic rollback path after tests fail, which is dangerous because an agent may execute it without understanding whether unrelated local changes or debugging artifacts will be lost.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

md

return 0
  else
    echo "❌ 测试失败，回滚集成"
    git reset --hard HEAD~1
    return 1
  fi
}

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This example script automatically merges open PRs with successful checks and deletes branches, with no confirmation, scope restriction, or warning. In an autonomous agent setting, that can cause unauthorized integration of flawed or malicious changes, accidental branch deletion, and bypass of human review expectations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 713)May include surrounding context.

md

- [多团队编程详细文档](./SKILL.md)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

git reset --hard HEAD~4 is even riskier because it discards the last four commits, potentially wiping multiple integrated changes at once. In an automated multi-team merge workflow, a mistaken or premature test failure could cause broad data loss and make recovery difficult if changes were not pushed or backed up.

Content

Scanner excerpt · SKILL.md (reported line 851)May include surrounding context.

md

echo "✅ 所有测试通过"
else
  echo "❌ 测试失败，回滚"
  git reset --hard HEAD~4
  exit 1
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The retry logic performs git reset --hard HEAD and git clean -fd, which together delete modified tracked content and untracked files in the team workspace. This is hazardous in agent-driven development because transient outputs, diagnostics, generated assets, or uncommitted fixes can be silently destroyed during automated retries.

Content

Scanner excerpt · SKILL.md (reported line 989)May include surrounding context.

md

# 清理失败的工作
      cd $WORKSPACE_BASE/$team
      git reset --hard HEAD
      git clean -fd
    fi
  done

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Although this occurrence appears in troubleshooting guidance rather than auto-executed logic, recommending git reset --hard <commit_hash> without an accompanying safety warning normalizes a destructive recovery pattern. Users or downstream agents may copy it verbatim and irreversibly discard local work.

Content

Scanner excerpt · SKILL.md (reported line 1220)May include surrounding context.

回滚到最后一个可工作的版本

git log --oneline -10 git reset --hard <commit_hash>

text

### 问题 4：性能问题

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Issue title and body are inserted into an LLM prompt that culminates in autonomous git push and gh pr create actions. This is a classic prompt-injection channel: a malicious issue can smuggle instructions that override task intent, exfiltrate data, modify unrelated files, or publish attacker-influenced code to the repository.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script bulk-ingests open GitHub issues and feeds their text into multiple autonomous coding agents, creating a scalable trust pipeline for prompt injection and social engineering. In this skill context, the danger is amplified because the agents operate concurrently and can each produce code changes and PRs, multiplying blast radius from a single malicious issue set.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Issue text from GitHub is untrusted input, yet the script inserts it into an autonomous prompt that explicitly instructs the agent to modify code, run tests, commit, push, create a PR, and emit completion events. This is a classic prompt-injection supply-chain risk: a malicious issue can smuggle instructions that steer the agent toward unsafe repository actions or secret disclosure under the appearance of normal task execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically merges PRs with gh pr merge --squash --delete-branch based only on a simplistic CI status check, with no human approval, branch protection validation, or content review. If an agent creates a harmful PR or CI is bypassed/misread, the workflow can directly land malicious or destructive changes into the main repository and delete forensic context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide states that AI runs locally and does not rely on cloud web services, implying a predominantly local workflow. However, elsewhere it instructs the user to automatically fetch GitHub Issues, create and merge PRs, wait on CI, and authenticate with GitHub CLI, all of which require remote network services and cloud infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide encourages automatic PR creation, waiting for CI, and automatic merging with minimal human review, but does not clearly warn that this can land incorrect, insecure, or malicious changes at scale. In a skill designed for unattended multi-agent coding, this materially increases supply-chain and repository integrity risk because users are encouraged to 'go get coffee' while changes progress toward merge.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples include branch deletion, worktree removal, and related repository-modifying actions without safety guidance, confirmation steps, or rollback instructions. In an automation-heavy workflow, destructive git operations can permanently discard local work or make incident recovery harder, especially when driven by AI agents and batch processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document advertises persisted login state as a feature but does not warn that Playwright storage state files may contain active session cookies or tokens. If these artifacts are stored insecurely or committed to version control, an attacker could reuse them to impersonate test users or access nonpublic environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.