ClawHub
Back to skill

Security audit

SZZG007 Multi Agent Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MOSSRIVER multi-agent workflow orchestrator, but it should be reviewed because it can direct customer-data processing, task reassignment, monitoring, and outbound email workflows with broad activation language and only generic safeguards.

Install only if you intend to use it inside the MOSSRIVER/OpenClaw operational environment. Before enabling live workflows, require explicit confirmation for outbound emails, customer or lead processing, task reassignment, retries, monitoring alerts, and any auto-optimization behavior; verify task queue paths, webhook destinations, audit logging, and retention settings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description presents capabilities such as email execution, customer screening, monitoring, and result aggregation without clearly warning users that these may affect external systems, process customer data, or trigger outbound communications. In this context, users may unknowingly initiate privacy-impacting or business-impacting actions, especially since the orchestrator delegates to multiple downstream agents and tools.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation section does not clearly define when the skill should or should not engage, and it lacks constraints, exclusions, or counterexamples. Because this skill coordinates other agents and can influence email sending, customer selection, and task routing, ambiguous scope increases the chance that unrelated user text is interpreted as authorization to orchestrate real workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad, everyday operational phrases such as '协调各 Agent 执行', '查看任务执行进度', and '重新分配这个任务', which can plausibly appear in normal conversation. In a skill that can orchestrate multiple agents, monitor work, and initiate external actions like email campaigns, accidental activation could cause unintended task dispatch, status exposure, or workflow changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该技能的标题、说明、触发词、使用方法和输出模板均仅以中文呈现，且未向用户提供语言/locale 选择。对于通用协作编排技能，这种单一语言约束属于自然语言层面的 locale 限制，但文档中没有给出用户选择或合规性理由。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.