Agent Orchestrator

Summary of what to check before installing: 1) Source and provenance: The skill's homepage is missing and the owner is an opaque ID. If you cannot verify the author (GitHub repo, published package, or community trust), treat it as untrusted until you can inspect the code. 2) Review sanitization and spawn logic: Open utils.py (and any functions named sanitize_untrusted_task, spawn_agent, SessionManager.spawn_session). Confirm that these functions: - Do not forward raw user input into sub-agents without robust sanitization or a safety preamble. - Do not include hidden network endpoints or secrets in sub-agent tasks. - Use an allowlist for OpenClaw subcommands (sessions_spawn, sessions_list, sessions_history) as claimed. 3) Verify persistence behavior: Inspect the state-file writing code to ensure it redacts keys and does not persist full task contents or outputs containing secrets. If you will run in production, keep ORCHESTRATOR_SAFE_STATE=1 and ensure state files are stored in a controlled directory with proper file permissions. 4) Test in a sandbox: Run the skill in an isolated environment and exercise edge cases (malicious-looking inputs) to confirm the sanitization actually prevents prompt injection in spawned sessions. 5) Search the code for network I/O: Grep for requests, urllib, socket, http, or hardcoded URLs/IPs. The docs claim no external network calls, but verify this in the code to be safe. 6) Check for scanner-evasion indicators: The changelog note about rewording safety preambles to reduce false positives is unusual; confirm it did not remove protections. Prefer the explicit sanitization code and tests (tests/security_test_plan.md) over wording in docs. 7) If you need stronger guarantees: require a code review by a trusted developer or only use in non-sensitive contexts. Do not pass secrets or credentials into tasks; run initial evaluations with low-sensitivity inputs. If you want, I can: (A) locate and summarize the sanitize_untrusted_task / spawn_agent code for you, (B) search the repository for network calls and file write paths, or (C) produce a short checklist of concrete grep commands to run locally to validate the points above.