Multi-Agent Coordinator

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 0.1.0

Overview

This is a disclosed multi-agent coordinator, but it can launch broad worker agents that edit files, run commands, use web tools, and persist task data without strong scoping or safety gates.

Install only in a workspace where you are comfortable with spawned agents using your current OpenClaw permissions. Review generated prompts before calling sessions_spawn, avoid including secrets in task text or context, keep implementation workers under manual review, and clean up kept sessions plus .openclaw scratchpad files after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

self.tool_uses += 1
        import subprocess
        try:
            result = subprocess.run(
                command,
                shell=True,
                capture_output=True,

• Confidence: 99% confidence
• Finding: The bash tool executes an arbitrary string with subprocess.run(..., shell=True), which enables shell injection and unrestricted command execution if task content or upstream inputs are attacker-controlled. In this skill, workers are explicitly described as having full tool access, so exposing raw shell execution materially increases the chance of repository compromise, secret theft, or host-level abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation advertises and instructs use of capabilities equivalent to file read/write, shell execution, and worker/session orchestration, but it does not declare permissions or provide an explicit capability/side-effect disclosure. In an agent ecosystem, this weakens informed consent and policy enforcement because users may invoke a skill without realizing it can create files, run commands, and coordinate other agents.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior does not fully match the effective behavior described by the analyzer: direct file editing, shell execution, scratchpad writes, and messaging/broadcast support materially expand the attack surface beyond a simple coordinator. This mismatch is dangerous because operators may grant trust based on the description while the actual implementation can perform broader local actions and inter-agent communication than advertised.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The code claims the coordinator cannot directly execute commands, yet it defines worker capabilities including bash, web_search, and web_fetch without any actual enforcement boundary or permission checks. In an agent system, a purely declarative tool split is not a security control, so downstream integrations could let coordinator-driven tasks trigger powerful actions indirectly.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The worker prompt explicitly authorizes spawned agents to use broad tools including edit, bash, and web_search, which materially expands capability from orchestration into arbitrary code execution and data access. In a multi-agent system, this increases the blast radius of prompt injection or task abuse because each spawned worker may act with powerful permissions on the local workspace and external resources.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The implementation phase instructs child agents to make code changes directly, turning the coordinator into a delegated code-writing and modification system. If upstream tasks or synthesized specs are poisoned, workers may introduce malicious changes or unsafe edits at scale without meaningful validation.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Verification workers are told to run tests and inspect regressions, implying execution of project commands in child sessions. That creates a command-execution pathway where untrusted repositories, test hooks, or poisoned instructions can trigger harmful local actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly describes persistent storage of worker prompts, state, and results under predictable paths, but provides no warning that these files may contain sensitive user tasks, code, secrets, or internal analysis. In a multi-agent orchestration skill, this creates a real confidentiality risk because users may unknowingly leave sensitive data on disk where it can be retained, copied, or accessed by other local processes or later sessions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The usage instructions tell users to pass task content directly into `sessions_spawn` for real parallel worker execution, but do not disclose that task contents will be exposed to spawned agent sessions. In this skill's context, that omission is security-relevant because users may assume local coordination only, while actually propagating sensitive instructions or repository data to multiple parallel contexts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The quick-start instructions tell users to generate prompts, create runtime files, and spawn real worker sessions, but they do not warn that these actions have persistent side effects and can trigger autonomous downstream actions. In a multi-agent skill, silent session spawning and filesystem writes increase the risk of unintended resource use, unauthorized modifications, or confusing provenance of outputs.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly states that workers have full tool access, including file write, shell, and web capabilities, but does not pair that power with strong user-facing warnings, approval boundaries, or least-privilege constraints. In a multi-agent orchestration skill, this increases the risk that spawned workers perform destructive actions, modify sensitive files, or access external resources without the user fully understanding the blast radius.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The scratchpad writes arbitrary content to disk under a predictable local directory with no user disclosure, retention policy, or sensitivity filtering. Tasks, prompts, and results in agent systems often contain secrets, proprietary code context, or personal data, so silent persistence increases the risk of unintended local disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Worker specifications and notifications are persisted to disk and may include task text, context, and results that can contain sensitive information. Because this is a multi-agent orchestration skill, these artifacts can aggregate a large amount of operational context, making local disclosure more dangerous than a normal log file.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Worker task contents are persisted to disk in .openclaw/multi-agent without any disclosure, minimization, or sensitivity check. Tasks can easily contain proprietary code snippets, credentials, incident details, or other sensitive prompts that should not be silently stored long-term.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The scratchpad persists worker specifications, notifications, and workflow artifacts, potentially including sensitive task data and generated results. Silent cross-worker persistence can expose confidential information to later workers, local users, or other processes if the directory is accessible.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: Session history retrieval collects worker outputs and later stores XML notifications to disk, creating an implicit logging channel for potentially sensitive model output. In this context, child agents may process codebase data, secrets, or internal reasoning artifacts, so silent collection materially increases privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.