War Room

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a benign local planning workflow, but it creates persistent project files and reuses them across multiple subagents.

Before installing, understand that this skill is a local multi-agent planning process: it will create a war-rooms project folder, persist your brief and outputs, and have subagents read each other's files. Use a dedicated workspace, avoid adding secrets to the brief or DNA, and review the generated files between waves.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Running the script creates local files and directories; unusual project or workspace paths could create them somewhere other than intended.

Why it was flagged

The reviewed initialization script is user-run local shell code that creates folders and template files based on the provided project/workspace values.

Skill content

DIR="${WORKSPACE}/war-rooms/${PROJECT}" ... mkdir -p "$DIR"/{agents,comms,lessons,artifacts}

Recommendation

Inspect the script before running, run it from the intended workspace, use a simple kebab-case project name, and do not run it with elevated privileges.

Low

#ASI06: Memory and Context Poisoning

What this means

Incorrect, sensitive, or hostile content placed in the war-room files may be reused or amplified in later outputs.

Why it was flagged

Subagents are instructed to load persistent project files and prior agent outputs into their working context, which is expected for this workflow but means those files can influence later agents.

Skill content

## Your DNA
{contents of DNA.md}
...
1. Read DECISIONS.md for prior decisions
2. Read agents/*/ folders for prior wave outputs

Recommendation

Keep each war room in a dedicated folder, review BRIEF.md, DNA.md, DECISIONS.md, comms, and prior outputs before continuing, and avoid placing secrets in session files.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any agent's local messages or challenges may influence the session, so inaccurate or unreviewed comms can steer the final blueprint.

Why it was flagged

The skill intentionally uses local files as the communication channel between subagents; this is disclosed and purpose-aligned, but messages can affect later decisions.

Skill content

All inter-agent communication uses the filesystem. ... `comms/` | Cross-agent messages and challenges | Any agent

Recommendation

Review comms and challenge files during pivot gates, and keep role ownership/folder conventions clear when running a session.