Agent Team Organization

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:39 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent OpenClaw Teams UI guide, but it includes an under-scoped instruction to patch the live gateway runtime bundle directly.

Install only if you are comfortable with a skill that can guide edits to OpenClaw Teams UI/gateway code and persistent team registry data. Require any runtime fix to be made in source, rebuilt, tested, and deployed with backup and rollback; do not allow direct patching of a live gateway bundle except under explicit emergency operator control.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/runtime-troubleshooting.md:82

Finding

Unsafe Direct Patching of the Active Gateway Runtime Bundle

Content

View full analysis

Vulnerability Details

File Location: references/runtime-troubleshooting.md, lines 82-88
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Documentation Snippet:

markdown

### If rebuild output is not taking effect

If the correct source exists but the deployed runtime still serves stale code:
1. locate the exact runtime bundle used by the gateway
2. patch the active bundle if necessary
3. restart the gateway
4. verify by saving again and re-reading the registry file

Technical Analysis

The troubleshooting guide explicitly authorizes an agent to patch the executable runtime bundle used by the live gateway. Directly modifying a deployed bundle bypasses the normal source review, reproducible build, testing, and artifact-integrity controls that help ensure deployed code corresponds to reviewed source code.

The instruction does not require the agent to:

• create and validate a backup before modification;
• confirm the identity and integrity of the active artifact;
• constrain modifications to the affected team-normalization logic;
• review or test the resulting bundle before activation;
• record the deployed modification in source control;
• define an automatic rollback procedure.

Restarting the gateway immediately after patching activates the unreviewed runtime change. This can result in source/runtime drift and makes later auditing difficult. The documentation does not itself contain malicious code, and exploitation remains limited by the filesystem and service-management permissions already available to the executing agent.

Attack Path

1. An agent encounters a Teams save issue and follows the runtime troubleshooting guide.
2. The agent locates the bundle currently executed by the gateway.
3. The agent edits that active bundle directly instead of rebuilding from reviewed source.
4. A malicious, compromised, or erroneous modificatio ...[truncated 924 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to patch the active runtime bundle directly.
2. Require all fixes to be made in version-controlled source files and reviewed before deployment.
3. Produce the runtime artifact through a documented, reproducible build process.
4. Verify the generated artifact with a cryptographic checksum or signature before deployment.
5. Deploy through an atomic replacement process rather than editing an artifact in place.
6. Back up the previous verified artifact and define a tested rollback procedure.
7. Run targeted tests confirming that parentId is preserved before restarting the production gateway.
8. Use least-privilege deployment credentials and separate source-editing permissions from production deployment permissions.
9. After deployment, verify that the active artifact hash matches the approved build output and record the deployment for auditability.
10. If emergency runtime modification is unavoidable, require explicit operator approval, a narrowly scoped patch, integrity validation, complete change logging, and immediate reconciliation back into reviewed source.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: agent-team-organization
description: "Create and maintain a Teams management page for OpenClaw Control UI, including named agent teams, parent/child nesting, indented tree rendering, collapsible team groups, parent selectors, and file-backed team registry persistence. Use when building, extending, fixing, or documenting the OpenClaw Teams page, team hierarchy UX, or gateway/UI plumbing for team organization features."
---

# Agent Team Organization

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown skill description explicitly states that it creates and maintains a file-backed team registry, which can affect local user or system data. The document does not include any warning or disclosure that using the skill may read from or write to ~/.openclaw/workspace/teams/teams.json.

Content

No source excerpt is available for this finding.