ClawHub
Back to skill

Security audit

Agent Avengers

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for multi-agent orchestration, but it needs review because it can broadly delegate work to multiple agents and profiles without tight activation or cleanup boundaries.

Install only if you intentionally want a multi-agent orchestration skill. Use explicit bounded prompts, review generated sessions_spawn and sessions_send commands before running them, avoid credentials or sensitive private data, verify output paths, and manually confirm cleanup of spawned sessions and mission artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Tainted flow: 'mission_path' from os.environ.get (line 20, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
if updates:
        mission.update(updates)
    
    with open(mission_path / "mission.json", "w") as f:
        json.dump(mission, f, indent=2, ensure_ascii=False)
Confidence
92% confidence
Finding
with open(mission_path / "mission.json", "w") as f:

Tainted flow: 'output_path' from os.environ.get (line 196, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
else:
        output_path = mission_path / "FINAL_REPORT.md"
    
    with open(output_path, "w") as f:
        f.write(report)
    
    # 상태 업데이트
Confidence
96% confidence
Finding
with open(output_path, "w") as f:

Tainted flow: 'mission_path' from os.environ.get (line 21, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
if updates:
        mission.update(updates)
    
    with open(mission_path / "mission.json", "w") as f:
        json.dump(mission, f, indent=2, ensure_ascii=False)
Confidence
90% confidence
Finding
with open(mission_path / "mission.json", "w") as f:

Tainted flow: 'log_file' from os.environ.get (line 49, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
"data": data or {}
    }
    
    with open(log_file, "a") as f:
        f.write(json.dumps(entry, ensure_ascii=False) + "\n")
Confidence
89% confidence
Finding
with open(log_file, "a") as f:

Tainted flow: 'script_path' from os.environ.get (line 205, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
"""실행 스크립트를 파일로 저장"""
    script_path = mission_path / "execute_commands.md"
    
    with open(script_path, "w") as f:
        f.write("# Avengers Execute Commands\n\n")
        f.write("OpenClaw 세션에서 아래 명령어들을 실행하세요.\n\n")
Confidence
88% confidence
Finding
with open(script_path, "w") as f:

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documents capabilities and workflows that delegate tasks to spawned agents, existing agents, and other profiles, including examples that imply file modification, shell-like coding/testing activity, and access to environment-backed tooling, yet it declares no permissions. This creates a dangerous mismatch where operators or downstream systems may underestimate the skill's effective authority, especially because it is an orchestration skill that can amplify access across multiple agents and sessions.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The example trigger uses broad natural-language phrasing like "어벤저스 어셈블!" without defining strict activation boundaries, which can cause accidental or contextually inappropriate invocation. In a multi-agent orchestration skill, unintended activation is more dangerous because it may spawn multiple agents, decompose tasks automatically, and amplify downstream actions or resource use.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation guidance is very broad and invites use on any 'complex task' without defining boundaries, approval requirements, or prohibited domains. In a multi-agent orchestration skill, this increases the chance of overbroad delegation, accidental triggering, or use on sensitive/high-risk tasks without adequate safeguards.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The invocation is broad and encourages use on arbitrary 'complex task' inputs without defining scope limits, safety boundaries, or excluded task categories. In a multi-agent orchestration skill that can decompose work, spawn agents, and coordinate execution, this increases the chance that unsafe, high-impact, or policy-violating tasks will be accepted and amplified across multiple sub-agents.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes broad natural-language phrases such as '멀티에이전트 자동화', '에이전트 팀 구성', and '자동 에이전트' that could match ordinary user requests rather than an intentional invocation of this skill. Because this skill can spawn and coordinate multiple agents, accidental activation could expand the scope of actions taken and cause unintended delegation or resource usage.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The example prompts encourage activation from general requests like '이 프로젝트를 병렬로 진행해줘' and '멀티에이전트로 자동 처리해줘' without defining exclusions or confirmation requirements. In the context of a powerful orchestration skill, this increases the risk of over-triggering and launching multi-agent workflows when a user may only be asking for ordinary assistance.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrase at line 15 is broad and conversational enough to be invoked unintentionally, especially in ordinary discussion about agents or teams. In a skill that orchestrates multi-agent automation, accidental activation can launch complex workflows, increasing operational and security risk beyond a typical passive skill.

Vague Triggers

Low
Confidence
83% confidence
Finding
The manifest exposes several triggers but does not document clear activation boundaries, exclusions, or confirmation requirements. For an orchestration skill that can spawn multiple agents and run long tasks, unclear trigger conditions increase the chance of unintended execution and misuse through ambiguous prompting.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.