Security audit

多 Agent 团队协作

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real OpenClaw team deployment helper, but its deployment script handles credentials and user-provided paths/code unsafely enough that it should be reviewed before installation.

Install only after reviewing or fixing scripts/deploy.sh. In particular, do not run it as root or against production OpenClaw credentials until identifiers are strictly validated, generated Python is data-driven rather than source-interpolated, path containment is enforced, and child agents receive scoped credentials instead of copies of the main auth profile.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/deploy.sh:107
Finding: Arbitrary Command Execution Through Unvalidated Bash Array Subscripts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/deploy.sh:232
Finding: Arbitrary Python Code Injection Through an Unquoted Generated Heredoc
Content: View full analysis
/dev/null || echo "")""" ``` ### Technical Analysis The heredoc delimiter is unquoted, so Bash performs parameter expansion and command substitution on its body before passing it to Python. The attacker-controlled `TEAMS` value is inserted directly into executable Python source: ```python teams = "$TEAMS".split() ``` A team ID containing quotes and Python syntax can terminate the intended string literal and inject additional Python statements. The generated content is then immediately interpreted by `python3`. The script also embeds the result of `declare -p TEAM_MEMBERS` in a Python triple-quoted string. This mixes shell-generated representations with executable source and creates an additional fragile parsing boundary. The underlying issue is treating untrusted data as program source instead of passing it through a structured data channel. ### Attack Path 1. An attacker starts the deployment script and selects a mode that accepts custom team identifiers. 2. The attacker enters a team ID containing Python string-termination syntax and an additional Python statement. 3. The value is appended to `TEAMS` without validation or encoding. 4. `generate_config_snippet` expands `TEAMS` into the unquoted heredoc. 5. Python parses the attacker's content as executable code rather than as a team name. 6. The injected Python statement executes with the deploymen ...[truncated 627 chars]
Remediation: View remediation
"$OUTPUT_FILE" <<'PYTHON' import json import os teams = json.loads(os.environ["OPENCLAW_TEAMS_JSON"]) PYTHON ``` 4. Construct the environment value with a trusted JSON serializer rather than manual quoting. 5. Validate every team and member identifier before serialization. 6. Remove the `declare -p` embedding. It is a shell-language representation, not a safe interchange format. 7. Keep user-controlled values exclusively in data structures and never evaluate them with `exec`, `eval`, or generated source. 8. Add regression tests using quotes, triple quotes, newlines, backslashes, semicolons, and Python syntax. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/deploy.sh:113
Finding: Directory Traversal Through Unvalidated Team and Member Identifiers
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/deploy.sh:193
Finding: Main-Agent Authentication Profiles Are Replicated to Every Generated Agent
Content: View full analysis
/dev/null || true cp "$OPENCLAW_DIR/agents/main/agent/models.json" \ "$OPENCLAW_DIR/agents/teams/$team/agent/" 2>/dev/null || true # 获取成员列表并复制 if [ -n "${TEAM_MEMBERS[$team]}" ]; then members="${TEAM_MEMBERS[$team]}" else members="${TEAM_TEMPLATES[$team]}" fi IFS=',' read -ra MEMBER_ARRAY <<< "$members" for member in "${MEMBER_ARRAY[@]}"; do member=$(echo "$member" | xargs) if [ -n "$member" ]; then cp "$OPENCLAW_DIR/agents/main/agent/auth-profiles.json" \ "$OPENCLAW_DIR/agents/teams/$team/$member/agent/" 2>/dev/null || true cp "$OPENCLAW_DIR/agents/main/agent/models.json" \ "$OPENCLAW_DIR/agents/teams/$team/$member/agent/" 2>/dev/null || true fi done done log_info "认证配置复制完成" } ``` ### Technical Analysis The script copies the main agent's complete `auth-profiles.json` into every generated team leader and member directory. This violates least privilege because all generated agents receive the main agent's credential material rather than narrowly scoped, agent-specific credentials. The number of credential copies grows with every generated agent. Compromise of any one destination can therefore expose credentials originating from the main agent. The operation also interacts dangerously with the path-traversal vulnerability: a crafted destination can cause credential files to be copied outside the intended hierar ...[truncated 1439 chars]
Remediation: View remediation
/dev/null || true` with explicit error handling and rollback for credential operations. 8. Maintain a credential inventory and support revocation for each generated agent. 9. Warn the operator before any sensitive credential propagation and require explicit confirmation. 10. Combine this remediation with strict path validation and symbolic-link defenses. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill advertises interactive deployment, presets, custom team creation, and hybrid mode, but the analyzed behavior reportedly only reads local configuration and invokes openclaw CLI checks for audit/verification. This mismatch can mislead users into granting trust or running commands under false assumptions, which is a security-relevant integrity issue because operators may execute a skill believing it performs safe deployment logic when it actually inspects local state and performs validation actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation is entirely in Chinese and the interactive examples explicitly require Chinese input such as '团队名称 (中文，如代码开发团队)'. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description forces a specific language/locale presentation for users by providing the core skill summary only in Chinese. The file does not indicate that the skill is region-specific or that users may choose another language, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The operational instructions, usage guidance, and warnings are all written in Chinese, effectively imposing a language requirement on users. There is no opt-in, alternative language, or documented reason that the skill must be Chinese-only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest and script banner emphasize support for 自定义团队结构, and earlier code collects custom team/member input. However, the Python generator does not parse or use TEAM_MEMBERS; it explicitly comments '简化处理，使用预设' and builds agent lists from hardcoded presets or ['member1', 'member2'], so the actual deployed config snippet does not reflect the user's custom structure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The --preset path immediately backs up configuration, creates directories under /root/.openclaw, and copies authentication-related files without prompting the user or printing a clear warning before making those changes. Although the interactive path has a confirmation for preset selection, that disclosure does not apply when the script is run directly with --preset.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's comments and all user-visible status messages are in Chinese, including the banner and validation results. This imposes a specific language on users without opt-in or documented locale justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package description is written only in Chinese ("交互式部署多 Agent 团队协作架构，支持自定义团队结构") with no indication that users can choose another language or that the skill is intended exclusively for a Chinese-language audience. This creates a natural-language locale constraint in metadata that may violate language-choice policy for general-purpose skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments and all interactive prompts are written in Chinese, and the script does not provide any option to select another language or indicate that it is intended only for a Chinese-speaking environment. This creates a natural-language locale constraint without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The comment '# 读取团队成员' suggests the generator will consume the collected team member configuration. In practice, the next line notes '简化处理，使用预设', and the loop uses presets.get(...) rather than parsed TEAM_MEMBERS, which contradicts the stated intent of that section.
Content: No source excerpt is available for this finding.