Agent Orchestrator

• Analyzed: May 14, 2026, 4:09 AM
• Findings: 1
• Version: 1.0.5
• Hash: 414ed54ee87bc3e4de55b15ad06d99a737184f27bab54159f96f38767dac000a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw Agent Orchestrator skill is designed for legitimate multi-agent orchestration. It demonstrates a strong commitment to security, implementing multiple layers of defense against prompt injection (e.g., `sanitize_untrusted_task`, `SECURITY_PREAMBLE` in `utils.py`) and arbitrary command execution (e.g., `ALLOWED_OPENCLAW_SUBCOMMANDS` allowlist in `utils.py`). Sensitive data is redacted in local state files by default. The `SECURITY.md` and `CHANGELOG.md` explicitly detail the threat model, mitigations, and ongoing security hardening, indicating a proactive and transparent security posture. No evidence of intentional malicious behavior (e.g., data exfiltration, unauthorized remote control, persistence) was found; remaining risks are inherent vulnerabilities of LLM systems, not malicious design.