ClawHub
Back to skill

Security audit

Agent Orchestrator — 多代理协同编排

Security checks across malware telemetry and agentic risk

Overview

This skill is a documentation-only multi-agent orchestration guide with disclosed subagent behavior and no executable payload or hidden install mechanism.

Install only if you want your agent to delegate work to subagents. Review prompts before using broad requests like 'then' or 'assign tasks,' because child agents may inherit the main agent's permissions and increase token or tool usage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill defines activation cues such as '并行分析', '同时查', '先...再...', and '然后', which are common conversational phrases rather than tightly scoped commands. In an orchestration skill that can spawn multiple subagents, broad triggers increase the chance of accidental activation, causing unnecessary fan-out, unintended task delegation, or expanded privilege use across child agents.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The coordinator triggers like '分配任务', '组建团队', and '分工协作' are ambiguous and map to ordinary user intent that may appear in many benign requests. Because this skill manages agent teams and task routing, ambiguous coordinator activation can cause the system to create subagents or distribute work without a sufficiently explicit user request, increasing operational and security risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.