Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only team-coordination skill that persistently stores shared project notes, with the main risks disclosed and user-directed.
Install only if you want agents to maintain a persistent shared team folder and add workspace guidance pointing to it. Choose DEV_TEAM_ROOT deliberately, keep it out of sensitive repos unless intended, do not store real passwords or API keys in the shared Markdown files, and enable multi-agent routing, channels, or scheduled work only with the sandbox and tool permissions you actually want.
Referenced artifact was not completely inspected
/creating-skills), **`{baseDir}`** is the directory that contains this skill’s `SKILL.md` after installation. That is **orthogonal** to **`TEAM_ROOT`**: `{baseD
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.DS_Store
.env
**/*.pem
**/secrets*
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Sandbox and Docker
If each agent runs in an isolated sandbox or container, **file tools** only see what is mounted. Mount **`TEAM_ROOT`** at the **same absolute path** in every container that must read or write `team/customers/.../tasks/...`, etc. See [Sandboxing](https://docs.openclaw.ai/gateway/sandboxing).
## `AGENTS.md` snippet (every participating agent workspace)
The line describes a language change affecting all skill-facing prose and prompts, implying the skill now forces English. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as justified; this changelog entry provides neither.
The changelog example explicitly states "all skill text in English," which conveys a fixed language requirement in the skill's natural-language guidance. The file does not offer an opt-in language choice or explain a region/compliance reason for enforcing English, so this is a locale-policy issue under the stated rule.
The document explicitly states that multiple agents 'all read/write the same area (absolute paths)' in a shared TEAM_ROOT, but it does not warn about race conditions, accidental overwrites, prompt-poisoned shared state, or integrity controls. In this skill's context, multiple autonomous agents with shared memory and handoffs increase the chance that one compromised, confused, or simply buggy agent can corrupt team state or influence others through shared files.
No suspicious patterns detected.