Security audit

结构化任务规划与分步执行 V2（异步子代理架构）

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed task-orchestration skill, but it deserves Review because it can create background cron jobs, inspect OpenClaw session state, and direct host-level cleanup actions that are not tightly scoped.

Install only if you are comfortable with a planner that can spawn subagents, schedule recurring heartbeat jobs, read OpenClaw session history, and perform cleanup that may terminate work or delete task records. Use explicit /stp invocation, review the generated plan before confirming, avoid placing sensitive data in task prompts, and do not enable completion cleanup unless losing the task directory is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill describes file reads/writes and shell-style operations but does not declare corresponding permissions, creating a capability transparency gap. That makes it easier for a planning-oriented skill to perform filesystem and command execution actions without clear operator awareness or policy gating.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior goes beyond structured task planning into persistent host orchestration: cron creation/deletion, reading session state files, and potentially deleting task directories. This mismatch is dangerous because users and policy systems may approve the skill for benign planning while it actually gains ongoing scheduler control and local state inspection/destruction abilities.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation instructs the agent to manage cron jobs and terminate processes at the host level, which exceeds the normal scope of a task-planning skill. Even if intended for cleanup, these operations can affect unrelated system activity and create persistence or denial-of-service risks if identifiers are wrong or manipulated.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Directly extracting PIDs from session history and issuing kill commands is a high-risk host action because parsing errors, spoofed output, or stale PID reuse can terminate unrelated processes. In the context of a planning skill, this is especially dangerous because it crosses from orchestration into unrestricted operating-system process control.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Automatic creation and deletion of cron jobs gives the skill persistent scheduler control beyond the immediate user interaction. That expands blast radius by allowing continued background execution, repeated state access, and accidental or malicious persistence not clearly justified by the declared skill purpose.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The skill creates and removes global cron jobs as part of normal task execution, which extends its effects beyond the task workspace and persists activity over time. In an agent-skill context, that broadens blast radius: a task plan can cause recurring autonomous execution and interfere with other scheduled jobs without a clear per-task permission boundary.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The heartbeat logic reads global session metadata from ~/.openclaw/agents/main/sessions/sessions.json and then opens session files referenced there, outside the task directory. This exposes cross-task or cross-agent state to the skill and can leak operational data unrelated to the current task, especially if session_file paths in the metadata are not constrained.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The code can recursively delete the task directory on completion based on plan content, but this destructive behavior is not clearly surfaced in the skill description and occurs automatically during heartbeat cleanup. In an orchestration skill, hidden deletion behavior increases the risk of unintended data loss, especially if users do not realize completion monitoring can remove artifacts they expected to keep.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Broad trigger phrases like general task-planning terms can cause the skill to activate on ordinary user requests, unexpectedly invoking filesystem, shell, subagent, and scheduler behaviors. Because this skill has impactful side effects, over-broad activation materially increases the chance of unintended execution.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The guide explicitly instructs writing a user-derived task plan into a persistent workspace path without any notice, consent, retention policy, or data-minimization controls. Because task descriptions can contain sensitive user data, this creates a privacy and unintended data-retention risk, especially in shared or synced environments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Automatic shutil.rmtree(orchestrator.task_dir) is performed without an interactive confirmation or equivalent safety gate at the destruction point. If the task directory contains outputs, logs, or downloaded files needed for review, this can irreversibly destroy data as a side effect of routine monitoring.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.