Agent Recruitment
PassAudited by VirusTotal on May 7, 2026.
Overview
Type: OpenClaw Skill Name: agent-recruitment Version: 1.0.0 The skill bundle defines a structured workflow for 'recruiting' and managing new AI agents within the OpenClaw ecosystem. It focuses on creating isolated workspaces under `~/.openclaw/agents/`, configuring model settings, and setting up communication routes (e.g., Feishu/Lark). There is no evidence of malicious intent, data exfiltration, or unauthorized execution; the instructions in `SKILL.md` actually emphasize security through strict workspace isolation.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A group could become connected to a bot that reads and responds to all messages, potentially causing unwanted responses or routing mistakes.
The skill directs the agent to change routing so every message in a Feishu group is handled by a bot, not just explicit mentions. That is a high-impact communication change without a required approval or rollback step.
写入路由配置，明确该群消息100%路由到指定Agent ... 无需@mention机器人，直接响应群内所有消息
Require explicit per-group confirmation before writing route changes, show the planned route diff, default to @mention-only routing unless the user opts in, and document a disable/rollback procedure.
Someone using the skill with sufficient access could rebind groups or existing agents in ways that affect other users or workspaces.
The skill can alter existing agents, model bindings, and Feishu routing, but the artifacts do not define required admin privileges, account scope, or ownership checks for those changes.
给已有Agent增设路由入口 / 调整Agent绑定模型 ... 绑定飞书路由 ... 对应群会话ID（oc_xxx）
Specify the required administrator role, authorized account/profile, ownership checks, and approval requirements for changing existing agents or Feishu routes.
Group members may have their messages processed by an agent even when they did not directly address the bot.
Routing all group messages to an agent creates a broad message-flow boundary between Feishu group chat and the agent/LLM. The skill does not specify participant notice, data handling, or retention boundaries.
无需@mention机器人，直接响应群内所有消息
Use explicit opt-in routing, notify group members, document what messages are processed or stored, and limit automatic routing to approved groups.
Information placed into a generated agent's memory could influence future behavior or expose private context to that agent's later tasks.
The skill creates persistent per-agent memory files and directories. This is disclosed and aligned with isolated agent workspaces, but persistent memory can retain sensitive or incorrect context.
MEMORY.md # 独立记忆 ... memory/ # 独立记忆目录
Keep memory directories isolated as described, avoid storing secrets, periodically review memory contents, and define retention or deletion rules.