Multi-Agent AI Setup Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:14 AM UTC
• Version: 1.0.1

Overview

This is a setup guide, but it needs Review because it broadly tells agents to keep sandboxing off and includes under-scoped external install and messaging guidance.

Install only if you are comfortable with a guide that may influence agents to reduce sandbox isolation. Pin and verify any pip, npx, or git-installed components, avoid forwarding sensitive console logs to WhatsApp, and keep explicit user approval around sandbox changes, crons, ports, and configuration edits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:132

Finding

Global Security Policy Override Disables Sandbox Isolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:132-157 and SKILL.md:254-268
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

The Skill introduces mandatory, global operating rules and instructs the agent never to enable sandbox mode.

markdown

## BEZWZGLĘDNE ZAKAZY
- NEVER edit SOUL.md, AGENTS.md, MEMORY.md without explicit owner request
- If you see another agent (or yourself) overwriting a file → STOP, restore from backup
**SAFE examples:** LM Studio subagent generation, file reads, web search on trusted domains, `capture-idea` to `ideas/`
**NEVER examples:** editing SOUL.md/AGENTS.md, rm -rf, installing >35B models, opening ports, sandbox ON
### Recovery procedure

```bash
# 1. Check git history if workspace is a git repo
git log --oneline -20

# 2. Restore from backup
cp ~/.openclaw.bak.YYYYMMDD/workspace/SOUL.md ~/.openclaw/workspace/SOUL.md

# 3. If no backup: use Claude Code as external reviewer
# Claude Code can read files without being affected by OpenClaw's context
claude  # open Claude Code, read files, diagnose

Sandbox mode: never enable

On macOS with external drives + symlinks, sandbox mode kills the system:

text

Sandbox ON + symlinks to /Volumes/2TB_APFS/ = agent loses access to workspace

OpenClaw's sandbox mounts a container that can't follow symlinks to external volumes. Keep sandbox OFF always.

text

The Skill reinforces these directives by applying its decision framework to every operation:

```markdown
Every operation falls into one of three categories:

| Category | Action | Claude offline? |
|----------|--------|-----------------|
| SAFE | Do it | Do it |
| GRAY_ZONE | Ask Claude first | Defer 1h, retry |
| NEVER | Ask Claude first | Block, escalate to human |

**SAFE examples:** generowanie, subagenci LM Studio, odczyt plików, web search na zaufanych domenach, `capture-idea` do `ideas/`

**GRAY_ZONE examples
...[truncated 2126 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove absolute directives such as “never enable,” “Keep sandbox OFF always,” and rules purporting to govern every operation.
2. Keep sandbox isolation enabled by default.
3. Scope the compatibility warning specifically to macOS installations whose workspaces use symbolic links targeting external volumes.
4. Recommend safer alternatives, such as moving the workspace into an allowed path, explicitly mounting the required directory, replacing symlinks with supported mounts, or configuring a narrowly scoped filesystem exception.
5. Require informed user approval before reducing isolation, and clearly state the additional host-access risk.
6. Present the SAFE, GRAY_ZONE, and NEVER table as optional guidance rather than higher-priority agent policy.
7. State explicitly that platform safety policies and direct user instructions take precedence over the guide.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:199

Finding

Unpinned Third-Party Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:199, STORY.md:125, and STORY.md:151-154
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The installation instructions retrieve mutable package versions without pins, hashes, lockfiles, or other integrity controls.

bash

/path/to/mempalace-venv/bin/pip install mempalace

The same unpinned Python installation is repeated in STORY.md:

bash

~/mempalace-venv/bin/pip install mempalace

Additional packages are installed through npx without specifying reviewed versions:

bash

npx clawhub install openclaw-bridge      # Claude Code ↔ OpenClaw messaging
npx clawhub install shared-memory-stack  # memory architecture reference
npx clawhub install ralph-wiggum-loop    # Generator→Critic→Fixer→Verifier loop
npx clawhub install nerua1-setup-guide   # this guide as a loadable skill

Technical Analysis

Package names without exact versions resolve to mutable upstream releases. No lockfile, package hash, expected publisher identity, registry restriction, or signed provenance is provided. Consequently, the code installed when a user follows the guide may differ from the code that was reviewed.

The npx command may download and execute the clawhub package when it is not already installed. Python packages can likewise execute code during installation or later import and use. This creates a supply-chain trust boundary in which an upstream compromise, namespace takeover, malicious release, or compromised package-manager account could introduce arbitrary code.

The audit found no evidence that the named packages are currently malicious. The vulnerability is the absence of controls ensuring that users receive a specific reviewed artifact.

Attack Path

1. An attacker compromises an upstream package, publisher account, registry entry, or dependency.
2. The attacker publishes a malicious release under a package name ...[truncated 875 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact version that has been reviewed.
2. For Python, provide a locked requirements file with cryptographic hashes and install it using pip install --require-hashes -r requirements.txt.
3. Pin the package used through npx to an exact version instead of allowing dynamic latest-version resolution.
4. Document the expected registry, publisher identity, source repository, and artifact digest.
5. Prefer signed releases or package provenance verification where supported.
6. Run package inspection or security auditing before installation, particularly for packages that execute lifecycle scripts or install agent Skills.
7. Install into a dedicated virtual environment or other constrained environment and avoid administrator privileges.
8. Periodically review and intentionally update pinned versions rather than silently accepting upstream changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

6. Inter-agent communication: Claude Code ↔ OpenClaw

Claude Code can send messages to a running OpenClaw instance:

bash

openclaw agent --message "Review this SQL migration — is it safe?" --agent main --json

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md

mempalace search "test"

# Is LM Studio loaded?
curl -s <lm-studio-url>/v1/models | python3 -c "import json,sys; [print(m['id']) for m in json.load(sys.stdin)['data']]"

# Can Claude Code reach OpenClaw?
openclaw agent --message "ping" --agent main --json | python3 -c "import json,sys; d=json.load(sys.stdin); print('OK:', d['status'])"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to load the skill when 'setting up a new system or onboarding a new agent,' which is a high-level condition rather than a specific invocation trigger. Without explicit trigger phrases, scope limits, or negative examples, this could overlap with many general setup or onboarding conversations and cause unintended activation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Why Claude Code before OpenClaw:

OpenClaw is powerful but fragile — it can lobotomize itself (overwrite its own config/personality). Claude Code acts as an independent safety net: it reads files directly, doesn't share OpenClaw's context window, and can diagnose/repair a broken OpenClaw from the outside.

text

Install order:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The embedded AGENTS.md example uses Polish-only policy headings and examples ('BEZWZGLĘDNE ZAKAZY', 'generowanie', 'odczyt plików'), and the decision framework later repeats Polish-only examples. This imposes a specific language in operational guidance without offering a user language choice or explaining a necessary region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The WhatsApp mirroring section describes bidirectional message replication between console and WhatsApp but does not clearly warn that logs, prompts, system state, or sensitive content may be copied to a third-party messaging platform. This can lead to inadvertent disclosure of secrets, internal reasoning, or operational data, especially in a 24/7 agent environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

bash

# Before any major change:
openclaw backup create

# Manual snapshot:
cp -r ~/.openclaw ~/.openclaw.snap.$(date +%Y%m%d-%H%M)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill recommends running npx clawhub inspect without pinning a specific package version. That causes execution of whatever version is current at install time, which creates a supply-chain risk if the package is updated maliciously or compromised. In a setup guide, users are likely to copy-paste this command directly, increasing practical exploitability.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · STORY.md (reported line 26)May include surrounding context.

md

### 1. Install Claude Code before OpenClaw

Counterintuitive, but important. OpenClaw can lobotomize itself — overwrite its own config and lose its personality, routing rules, everything. If you don't have something external that can diagnose and repair it, you're stuck.

Claude Code reads files directly, outside OpenClaw's context window. It can see what broke and how to roll it back.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The guide instructs users to run npx clawhub install ... without pinning a package version or validating integrity. This creates a supply-chain risk because a future malicious or compromised package release could be fetched and executed at install time, which is especially dangerous in a setup guide that users are likely to copy-paste verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command also uses unpinned npx clawhub, which may resolve to whatever package version is current at execution time. In an agent/bootstrap context, that can silently introduce unreviewed code into a highly privileged environment and affect all downstream components the guide configures.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Running npx clawhub install ... without version pinning exposes users to arbitrary upstream changes and possible package compromise. Because this skill is a setup guide for a multi-agent system with inter-agent communication and shared memory, a compromised installer could have broad access and persistence opportunities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The final npx clawhub install example repeats the same supply-chain pattern: executing a remote package manager without an exact version. Users following the guide may assume the command is safe and stable, but it can change over time or be hijacked through registry compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The orchestrator recommendation highlights that Kimi 'handles Polish,' which signals a language-specific preference in guidance. While mild, the document does not frame language as a user-selectable option or explain why Polish support is required in this setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The statement "never enable sandbox mode" is presented as an unconditional instruction rather than a context-sensitive choice, and it is expressed in natural language within the markdown. This can be treated as a policy-style directive that removes user discretion without documenting exceptions or offering an opt-in decision.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.