Agent Office

This skill implements a local multi-agent 'office' and mostly matches its description, but pay attention to these points before installing or running: - Metadata vs reality: the registry lists no required binaries/env vars, but the README/SKILL.md and code expect tools like git, uv, lsof, openclaw, hermes and several environment variables. Assume you must provide those to function. - Remote code download: DeerFlow runtime is cloned from a git repo at runtime and dependencies are synced (uv). If you override AGENT_OFFICE_DEERFLOW_REPO_URL, an attacker-controlled repo could be executed. Only use trusted repo URLs. - Host path exposure: AGENT_OFFICE_DEERFLOW_EXTRA_MOUNTS can mount arbitrary host paths into the embedded runtime. Do not set this to sensitive directories (e.g., ~/.ssh, /etc, or repos with secrets) unless you understand the risks. - Data leakage to external workers: the 'external' engine forwards tasks and shared memory to upstream HTTP workers; that can leak local context or secrets to whatever service is listening on the upstream URL. Treat upstream endpoints as trusted before bridging them in. - Arbitrary local command execution: 'cli' workers invoke local CLI executables (codex, claude, gemini, custom cli-cmd). This lets the skill run local programs — ensure those programs are trusted and that CLI args are controlled. - Process control and file deletion: remove_worker stops processes by port and deletes worker and DeerFlow home directories — be cautious when removing workers to avoid accidental deletion of important data. Recommended actions: - Inspect worker_server.py and the parts of the code that handle incoming tasks and outgoing network calls (not fully included here) before deploying. - Run in an isolated account or container if you will mount directories or point to untrusted upstreams/repos. - Do not set AGENT_OFFICE_DEERFLOW_EXTRA_MOUNTS or AGENT_OFFICE_DEERFLOW_REPO_URL to untrusted values; prefer the default trusted repo or a vetted internal fork. - Ensure required binaries (git, uv, lsof, openclaw/hermes/local CLIs) are installed from trusted sources. If you want, I can: (1) scan worker_server.py for endpoints and network behavior, (2) list every environment variable used across files, or (3) point to exact lines that implement git clone, mounts, and process-kill behavior.