Coding Agent Orchestrator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:16 PM UTC
• Version: 1.0.1

Overview

This skill is mostly aligned with controlling coding workstations, but it needs Review because it can act on live sessions and screenshots with broad triggers and inconsistent safety instructions.

Install only if you trust Varie Workstation, the wctl CLI, and your OpenClaw channel configuration. Use explicit workstation-related requests, verify the target session before dispatching or creating sessions, avoid forwarding untrusted text blindly, and treat full-screen screenshots as sensitive because they can include unrelated windows or secrets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:47

Finding

Shell Command Injection Through Unsafe Dynamic Argument Interpolation

Content

View full analysis

"" # SKILL.md:67 wctl create # SKILL.md:122 openclaw message send --media --channel --target # SKILL.md:165 wctl dispatch "4" wctl dispatch "" # SKILL.md:230-232 wctl dispatch-answers --chat-arrows 20 sleep 3 wctl dispatch "" ``` ### Technical Analysis The skill instructs the agent to insert dynamic values directly into shell command strings. These values include user messages, rejection feedback, repository names, filesystem paths, task identifiers, screenshot paths, channel names, and message targets. Enclosing a value in double quotes does not make it safe for shell evaluation. Shell constructs such as command substitution—`$(command)` or backticks—are still evaluated inside double quotes. An embedded quote may also terminate the intended argument and introduce shell metacharacters such as `;`, `&&`, redirections, or pipelines. The unquoted placeholders in `wctl create` and `openclaw message send` are additionally exposed to whitespace splitting, wildcard expansion, option injection, and shell metacharacter interpretation. For example, if a user message containing the following value is substituted into the documented dispatch template and executed through a shell: ```text Please inspect $(id > /tmp/workstation-injection-proof) ``` the shell may execute `id` before invoking `wctl`. A quote-breaking payload could similarly append an arbitrary command: ```text "; arbitrary-command; # ``` The security statement at line 310 claims that free text is never injected into PTY commands without validation. This conflicts with lines 165 and 232, which explicitly instruct the agent to dispatch a ...[truncated 2580 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger list includes very broad phrases such as 'yes', 'no', 'show me', 'start', 'stop', and 'project name', which are common in normal conversation and can cause the skill to activate unintentionally. In this skill's context, accidental activation is especially risky because it can dispatch commands to live coding sessions, interrupt processes, or capture screenshots without the user intending workstation control.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

| `wctl status --human` | Check daemon alive |
| `wctl list` | List sessions (JSON, for parsing) |
| `wctl list --human` | List sessions (readable, for user) |
| `wctl dispatch <id> "<msg>"` | Send message to existing session |
| `wctl dispatch-answers <id> <a1> <a2>...` | Send multi-question answers. Use `next:N` for multi-select |
| `wctl create <repo> <path> [task]` | Create new session |
| `wctl escape <id>` | Send Escape key (cancel prompt/menu) |

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

**Plan approval (4 options):**
| User says | Dispatch |
|---|---|
| "1", "clear context", "bypass all" | `wctl dispatch <id> "1"` |
| "2", "bypass permissions", "yes bypass" | `wctl dispatch <id> "2"` |
| "3", "approve", "yes", "go ahead", "lgtm", "manually approve" | `wctl dispatch <id> "3"` |
| "reject", "no", feedback like "change X to Y" | **Two steps:** `wctl dispatch <id> "4"` then wait 2s then `wctl dispatch <id> "<their feedback>"` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The workflow tells the agent to route requests silently and avoid asking the user unless ambiguity is detected. In a skill that can dispatch terminal input, create sessions, interrupt processes, and take screenshots, reducing explicit confirmation increases the chance of unintended actions from misclassification or broad trigger activation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Smart Routing (Main Workflow)

When the user mentions working on a project (e.g., "work on my-api", "resume frontend work", "start auth refactor"), follow this decision tree silently — do NOT ask the user unless you hit an ambiguous case:

Step 1: Check daemon + list sessions

bash

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The screenshot workflow instructs the agent to capture local images and send them through messaging channels, with CLI fallback requiring explicit channel and target identifiers. This can expose sensitive on-screen content and routing metadata, and the risk is amplified because the skill also supports full-screen capture, which may include unrelated applications or secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill text repeatedly frames operation around Telegram and WhatsApp as the user communication channels, including delivery of screenshots through those channels, without offering a user choice in the documented behavior. This can be read as enforcing a specific communication locale/channel policy rather than presenting it as optional or configurable by the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guardrails say the skill asks for confirmation before creating new sessions, but the main workflow instructs automatic session creation when no matching session is found. This inconsistency can cause unauthorized or unexpected workspace actions, reducing user control and making accidental project initialization more likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The security section claims free text is never injected into PTY commands without validation, but earlier workflow steps explicitly send raw user text via wctl dispatch <id> "<user's message>" and feedback flows dispatch arbitrary text after selecting option 4. This mismatch is dangerous because operators may rely on inaccurate guardrail documentation and approve use in situations where terminal-directed text could trigger unintended actions inside an active coding session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.