Agent Avengers

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-built for multi-agent orchestration, but it needs review because it can broadly delegate work to multiple agents and profiles without tight activation or cleanup boundaries.

Install only if you intentionally want a multi-agent orchestration skill. Use explicit bounded prompts, review generated sessions_spawn and sessions_send commands before running them, avoid credentials or sensitive private data, verify output paths, and manually confirm cleanup of spawned sessions and mission artifacts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tainted flow: 'mission_path' from os.environ.get (line 20, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

if updates:
        mission.update(updates)
    
    with open(mission_path / "mission.json", "w") as f:
        json.dump(mission, f, indent=2, ensure_ascii=False)

• Confidence: 92% confidence
• Finding: The code updates `mission.json` by writing to `mission_path`, which is ultimately influenced by the workspace environment variable and mission metadata without any path canonicalization or containment check. If an attacker can control `AVENGERS_WORKSPACE`, `mission_id`, or the stored `mission["path"]`, they may redirect writes to arbitrary filesystem locations, causing unauthorized file overwrite or corruption.

Tainted flow: 'output_path' from os.environ.get (line 196, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

else:
        output_path = mission_path / "FINAL_REPORT.md"
    
    with open(output_path, "w") as f:
        f.write(report)
    
    # 상태 업데이트

• Confidence: 96% confidence
• Finding: The script writes the final report to `args.output` when provided, with no restriction on destination path. In an orchestration tool that may run with elevated access or automation privileges, a user-supplied or indirectly attacker-controlled path can overwrite arbitrary files, enabling data loss, config tampering, or follow-on compromise.

Tainted flow: 'mission_path' from os.environ.get (line 21, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

if updates:
        mission.update(updates)
    
    with open(mission_path / "mission.json", "w") as f:
        json.dump(mission, f, indent=2, ensure_ascii=False)

• Confidence: 90% confidence
• Finding: The write target is derived from mission_path, which ultimately depends on an environment-controlled workspace and mission metadata without validation that the resolved path stays under the intended mission directory. An attacker who can influence AVENGERS_WORKSPACE, the mission ID, or mission.json contents could cause overwrites of arbitrary files accessible to the process.

Tainted flow: 'log_file' from os.environ.get (line 49, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

"data": data or {}
    }
    
    with open(log_file, "a") as f:
        f.write(json.dumps(entry, ensure_ascii=False) + "\n")

• Confidence: 89% confidence
• Finding: The log file path is built from mission_path and then opened for append without constraining the final resolved location. If mission_path is attacker-influenced through environment configuration or untrusted mission metadata, this can be abused to append data to arbitrary files, potentially corrupting configs or planting content in sensitive locations.

Tainted flow: 'script_path' from os.environ.get (line 205, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

"""실행 스크립트를 파일로 저장"""
    script_path = mission_path / "execute_commands.md"
    
    with open(script_path, "w") as f:
        f.write("# Avengers Execute Commands\n\n")
        f.write("OpenClaw 세션에서 아래 명령어들을 실행하세요.\n\n")

• Confidence: 88% confidence
• Finding: The script output file is written beneath mission_path, but mission_path is sourced from mission metadata rather than recomputed from a trusted base. A malicious or tampered mission file could redirect this write to an unintended filesystem location, leading to arbitrary file creation or overwrite within the process's permissions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents capabilities and workflows that delegate tasks to spawned agents, existing agents, and other profiles, including examples that imply file modification, shell-like coding/testing activity, and access to environment-backed tooling, yet it declares no permissions. This creates a dangerous mismatch where operators or downstream systems may underestimate the skill's effective authority, especially because it is an orchestration skill that can amplify access across multiple agents and sessions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example trigger uses broad natural-language phrasing like "어벤저스 어셈블!" without defining strict activation boundaries, which can cause accidental or contextually inappropriate invocation. In a multi-agent orchestration skill, unintended activation is more dangerous because it may spawn multiple agents, decompose tasks automatically, and amplify downstream actions or resource use.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation guidance is very broad and invites use on any 'complex task' without defining boundaries, approval requirements, or prohibited domains. In a multi-agent orchestration skill, this increases the chance of overbroad delegation, accidental triggering, or use on sensitive/high-risk tasks without adequate safeguards.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The invocation is broad and encourages use on arbitrary 'complex task' inputs without defining scope limits, safety boundaries, or excluded task categories. In a multi-agent orchestration skill that can decompose work, spawn agents, and coordinate execution, this increases the chance that unsafe, high-impact, or policy-violating tasks will be accepted and amplified across multiple sub-agents.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list includes broad natural-language phrases such as '멀티에이전트 자동화', '에이전트 팀 구성', and '자동 에이전트' that could match ordinary user requests rather than an intentional invocation of this skill. Because this skill can spawn and coordinate multiple agents, accidental activation could expand the scope of actions taken and cause unintended delegation or resource usage.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example prompts encourage activation from general requests like '이 프로젝트를 병렬로 진행해줘' and '멀티에이전트로 자동 처리해줘' without defining exclusions or confirmation requirements. In the context of a powerful orchestration skill, this increases the risk of over-triggering and launching multi-agent workflows when a user may only be asking for ordinary assistance.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase at line 15 is broad and conversational enough to be invoked unintentionally, especially in ordinary discussion about agents or teams. In a skill that orchestrates multi-agent automation, accidental activation can launch complex workflows, increasing operational and security risk beyond a typical passive skill.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The manifest exposes several triggers but does not document clear activation boundaries, exclusions, or confirmation requirements. For an orchestration skill that can spawn multiple agents and run long tasks, unclear trigger conditions increase the chance of unintended execution and misuse through ambiguous prompting.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.