Security audit

Team Dispatch

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits multi-agent orchestration, but its default setup adds persistent background jobs and broad agent delegation that should be reviewed before installation.

Install only if you are comfortable with this skill changing OpenClaw configuration, granting broad subagent delegation, and creating recurring background jobs. Before running setup, consider setting watcher.enabled=false and dailySummary.enabled=false or using --no-watch, and narrow allowAgents to the intended team roster.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

Location: scripts/setup.sh:422
Finding: Default Installation Creates a Persistent Background Watcher<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:422-487`, `config.json:12-20`, `scripts/watch-install.sh:221-277` **Vulnerability Type**: Default cross-session service and scheduled-task installation **Risk Level**: High ### Vulnerable Code Default configuration enables the watcher: ```json "watcher": { "enabled": true, "backend": "auto", "interval": 300, "grace": 20, "jobName": "Team Dispatch watcher", "jobDescription": "Low-frequency reconciliation: scan tasks/active for overdue in-progress tasks and reset to pending when retries remain.", "note": "Cross-platform background watcher installer. backend: auto|openclaw-cron|launchd|systemd|cron" } ``` The main setup process installs it unless the user supplies an opt-out: ```bash if [ "$NO_WATCH" -eq 1 ]; then echo " ⏭️ 已通过 --no-watch 禁用 watcher 安装" elif [ "$WATCH_ENABLED" = "0" ]; then echo " ⏭️ team-dispatch.json 中 watcher.enabled=false，跳过" elif [ "$ERRORS" -ne 0 ]; then echo " ⚠️ 安装存在错误（$ERRORS），跳过 watcher 安装" else echo " ▶︎ backend=$WATCH_BACKEND interval=$WATCH_INTERVAL grace=$WATCH_GRACE" INTERVAL="$WATCH_INTERVAL" GRACE="$WATCH_GRACE" bash "$SKILL_DIR/scripts/watch-install.sh" --backend "$WATCH_BACKEND" \ && echo " ✅ watcher 已安装/启用" \ || echo " ⚠️ watcher 安装失败（不影响主功能）。可手动运行: bash $SKILL_DIR/scripts/watch-install.sh" fi ``` On Linux with systemd, the installer creates an always-restarting user service: ```ini [Unit] Description=Team Dispatch low-frequency watcher After=network.target [Service] Type=simple Environment=INTERVAL=$INTERVAL Environment=GRACE=$GRACE ExecStart=/bin/bash $SKILL_DIR/scripts/watch.sh Restart=always RestartSec=3 [Install] WantedBy=default.target ``` ```bash run systemctl --user daemon-reload run systemctl --user enable --now team-dispatch-watch.service ``` The fallback creates a reboot-persistent crontab entry: ```bash LINE="@reboot INTERVAL=$INTERVAL GRACE=$GRACE /bin/bash $SKILL_DIR/scri ...[truncated 2751 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `team.watcher.enabled` to `false` in the shipped default configuration. 2. Require a separate, explicit command or interactive confirmation before creating any scheduled service. 3. Before installation, display the scheduler backend, executable path, execution frequency, log paths, and uninstall command. 4. Do not execute persistent services through a mutable Skill symlink. Install a version-pinned copy in a user-owned directory with restrictive permissions. 5. Verify ownership and integrity of the persistent executable before each launch. 6. Prefer a one-shot reconciliation command invoked on demand or when an actual completion event is missed. 7. Ensure uninstallation removes all supported backends, associated environment variables, logs, and service definitions. ]]>

T06 · System Persistence

Error

Location: scripts/setup.sh:490
Finding: Setup Registers a Daily Autonomous Main-Agent Job by Default<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:490-627`, `config.json:21-29` **Vulnerability Type**: Persistent scheduled autonomous agent execution **Risk Level**: High ### Vulnerable Code The daily job is enabled in the default configuration: ```json "dailySummary": { "enabled": true, "backend": "openclaw-cron", "cron": "0 22 * * *", "timezone": "", "jobName": "team-dispatch.daily-summary", "jobDescription": "Team Dispatch daily summary: aggregate completed tasks, progress, and status for the day" } ``` Setup constructs an autonomous prompt that scans task state: ```bash local MSG=$(cat <<'EOF' 请生成 Team Dispatch 的每日总结报告： 1. 扫描 ~/.openclaw/workspace/tasks/active/ 下的所有项目 2. 汇总今天完成的任务（根据 completedAt 判断） 3. 列出进行中的任务和当前状态 4. 识别任何失败或卡住的任务 5. 生成简洁的日报总结格式： 📊 Team Dispatch 日报 (YYYY-MM-DD) ✅ 今日完成: X 个任务 🔄 进行中: X 个任务 ⚠️ 需关注: X 个问题 EOF ) ``` It then registers a recurring isolated main-agent session: ```bash JOB_ID=$(openclaw cron add \ --name "$JOB_NAME" \ --cron "$CRON_EXPR" \ $TZ_ARG \ --session isolated \ --agent main \ --message "$MSG" \ --no-deliver \ --description "$DESC" \ --json 2>/dev/null | node -e "let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{try{const j=JSON.parse(s);process.stdout.write(j.jobId||j.id||'');}catch(e){process.stdout.write('');}});") ``` The installation is skipped only when explicitly disabled: ```bash if [ "$ERRORS" -ne 0 ]; then echo " ⏭️ 安装存在错误，跳过每日总结任务" elif ! command -v openclaw >/dev/null 2>&1; then echo " ⏭️ 未找到 openclaw，跳过每日总结任务" elif [ "$DAILY_SUMMARY_ENABLED" = "0" ]; then echo " ⏭️ config.json 中 dailySummary.enabled=false，跳过" else echo " ▶︎ cron='$DAILY_SUMMARY_CRON'${DAILY_SUMMARY_TZ:+ tz=$DAILY_SUMMARY_TZ}" install_daily_summary_job "$SKILL_DIR" "$DAILY_SUMMARY_NAME" "$DAILY_SUMMARY_CRON" "$DAILY_SUMMARY_TZ" "$DAILY_SUMMARY_DESC" fi ``` ### Technical Analysis The setup registers an OpenClaw cron task that starts an i ...[truncated 1805 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the shipped default to `"dailySummary": { "enabled": false }`. 2. Require explicit user consent before registering the job. 3. Show the full prompt, schedule, timezone, target agent, accessed directory, delivery behavior, and estimated recurring cost before confirmation. 4. Provide a non-persistent, on-demand summary command as the default behavior. 5. Restrict the scheduled process to structured metadata required for the summary rather than granting a general agent session access to all task content. 6. Add a setup option dedicated to enabling the summary instead of relying on configuration-based opt-out. 7. Ensure the main uninstall process removes the daily summary job as well as the watcher. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/watch-install.sh:239
Finding: Unvalidated Watcher Configuration Is Injected into Scheduler Definitions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/watch-install.sh:239-275`, with input loaded by `scripts/setup.sh:454-476` **Vulnerability Type**: Scheduler configuration injection **Risk Level**: High ### Vulnerable Code Setup reads the values from JSON and emits them as unrestricted strings: ```bash WATCH_INTERVAL=$(node -e " const fs=require('fs'); const home=process.env.HOME; const up=home+'/.openclaw/configs/team-dispatch.json'; const sp='$SKILL_DIR/config.json'; let u={}, s={}; try{ if (fs.existsSync(up)) u=JSON.parse(fs.readFileSync(up,'utf8')); }catch(e){} try{ if (fs.existsSync(sp)) s=JSON.parse(fs.readFileSync(sp,'utf8')); }catch(e){} const merged={...s, ...u, team:{...(s.team||{}), ...(u.team||{}), watcher:{...((s.team||{}).watcher||{}), ...(((u.team||{}).watcher)||{})}}}; process.stdout.write(String(merged.team?.watcher?.interval||300)); ") WATCH_GRACE=$(node -e " const fs=require('fs'); const home=process.env.HOME; const up=home+'/.openclaw/configs/team-dispatch.json'; const sp='$SKILL_DIR/config.json'; let u={}, s={}; try{ if (fs.existsSync(up)) u=JSON.parse(fs.readFileSync(up,'utf8')); }catch(e){} try{ if (fs.existsSync(sp)) s=JSON.parse(fs.readFileSync(sp,'utf8')); }catch(e){} const merged={...s, ...u, team:{...(s.team||{}), ...(u.team||{}), watcher:{...((s.team||{}).watcher||{}), ...(((u.team||{}).watcher)||{})}}}; process.stdout.write(String(merged.team?.watcher?.grace||20)); ") ``` Those values are interpolated directly into a systemd unit: ```bash SERVICE_DST="$UNIT_DIR/team-dispatch-watch.service" cat > "$SERVICE_DST" <<EOF [Unit] Description=Team Dispatch low-frequency watcher After=network.target [Service] Type=simple Environment=INTERVAL=$INTERVAL Environment=GRACE=$GRACE ExecStart=/bin/bash $SKILL_DIR/scripts/watch.sh Restart=always RestartSec=3 [Install] WantedBy=default.target EOF run systemctl --user daemon-reload run systemctl --user enable --now team-dispatch-watch.service ` ...[truncated 2804 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse `interval` and `grace` as integers before passing them to the installer. 2. Reject booleans, strings, floating-point values, negative values, newlines, whitespace, and shell metacharacters. 3. Enforce sensible bounds, such as a minimum interval and a maximum operational value. 4. Repeat validation inside `watch-install.sh`; do not rely solely on validation in `setup.sh`. 5. Generate systemd environment values using a safe escaping routine or a separate protected environment file. 6. Avoid constructing crontab entries through raw string concatenation. If cron remains supported, strictly format validated numeric values and safely quote every path. 7. Validate the completed systemd unit with `systemd-analyze verify` before enabling it. 8. Render the proposed scheduler definition for user review before installation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/setup.sh:215
Finding: Setup Grants the Main Agent Wildcard Delegation Authority<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:215-237`, `SKILL.md:62-84`, `scripts/verify.sh:115-125` **Vulnerability Type**: Excessive agent delegation permission **Risk Level**: Medium ### Vulnerable Code The new main-agent configuration grants access to every agent: ```javascript const mainAgentPatch = { id: 'main', default: true, name: 'main', workspace: home + '/.openclaw/workspace', agentDir: home + '/.openclaw/agents/main/agent', model: mainCfg.model || 'openai-codex/gpt-5.4', identity: { name: mainName, emoji: mainCfg.emoji || '🎯' }, subagents: { allowAgents: ['*'] }, }; ``` Existing configurations without an allowlist are broadened to wildcard access: ```javascript const idx = config.agents.list.findIndex(a => a.id === 'main'); if (idx === -1) { config.agents.list.unshift(mainAgentPatch); console.log(' ✅ main → 新增（dispatcher/root）'); } else { const existing = config.agents.list[idx]; existing.subagents ??= {}; if (!Array.isArray(existing.subagents.allowAgents) || existing.subagents.allowAgents.length === 0) { existing.subagents.allowAgents = ['*']; console.log(' 🔧 main → 设置 subagents.allowAgents=["*"]'); } } ``` The documented configuration explicitly requires the wildcard: ```json { "id": "main", "default": true, "name": "main", "workspace": "/Users/vvusu/.openclaw/workspace", "agentDir": "/Users/vvusu/.openclaw/agents/main/agent", "model": "openai-codex/gpt-5.4", "identity": { "name": "调度台", "emoji": "🎯" }, "subagents": { "allowAgents": ["*"] } } ``` ### Technical Analysis The Skill has a finite configured roster of worker agents, so orchestration only requires authority to launch those specific IDs. Granting `allowAgents: ["*"]` permits the dispatcher to invoke all current and future agents known to OpenClaw, including agents unrelated to Team Dispatch. This weakens the system's least-privilege boundary. If a malicious project description, c ...[truncated 1522 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `["*"]` with an explicit allowlist generated from the configured Team Dispatch roster. 2. Preserve existing restrictive policies and never broaden delegation permissions without confirmation. 3. Require explicit approval when adding a newly configured agent to the allowlist. 4. Validate task `agentId` values against the Team Dispatch roster before calling `sessions_spawn`. 5. Assign the narrowest tool profile required by each worker and avoid `full` profiles where a restricted profile is sufficient. 6. Update verification logic to require only the explicit configured roster and to reject wildcard delegation by default. 7. Log and surface attempts to invoke agents outside the approved roster. ]]>

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (148)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Content: for depId in task.dependsOn: dep = findTask(depId) prompt += "\n\n[{dep.id}] ({dep.agentId}): {dep.result}" return prompt ``` ### Step 4: 并行派发注意事项
Confidence: 96% confidence
Finding: The prompt builder directly injects upstream task results into downstream prompts without sanitization, delimiting, or trust separation. If an upstream result contains prompt-injection content or malicious instructions, it can manipulate downstream agents, causing privilege confusion, unsafe actions, or data leakage across task boundaries.

Ae1

High

Category: analysis-evasion
Content: | `scripts/doctor.sh` | 环境健康检查 | `bash <SKILL_DIR>/scripts/doctor.sh` |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file defines a domain-specific research analyst agent, while the skill metadata says this skill is for multi-agent workflow orchestration. This mismatch is dangerous because the wrong instructions can cause the system to invoke or configure an agent with capabilities and constraints unrelated to orchestration, leading to incorrect task routing, broken isolation assumptions, and unsafe cross-agent behavior in a dispatcher context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This bootstrap file is materially misaligned with the declared purpose of the skill. Instead of multi-agent workflow orchestration, it instructs identity construction, user profiling, memory creation, and optional messaging onboarding, which expands the skill's behavioral scope and can cause an agent to perform unauthorized data collection or account-linking tasks under a misleading label.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file clearly redefines the `team-dispatch` skill as a dedicated security-audit agent instead of a multi-agent orchestration skill, which is a scope-confusion and policy-integrity issue. In an agent framework, this can cause incorrect routing, privilege misuse, or execution under false assumptions about the skill’s purpose, especially if callers trust the metadata and invoke it for orchestration behavior that it does not implement.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This bootstrap file is materially misaligned with the declared purpose of a team-dispatch orchestration skill. Instead of task decomposition and workflow coordination, it redirects the agent into persona formation, user profiling, persistent memory creation, and optional external account onboarding, which expands capability and data access beyond what users would reasonably expect.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file's behavior is materially misaligned with the stated purpose of the 'team-dispatch' skill. Instead of orchestrating multi-agent workflows, it performs persona bootstrapping, persistent memory setup, and onboarding to external chat channels, which can cause the agent to take actions outside expected scope and collect/store unnecessary personal data.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file content does not match the declared skill purpose: instead of multi-agent workflow orchestration, it defines a trading-agent persona and operating guidance. This kind of skill/manifest mismatch is dangerous because it can cause the wrong capability to be invoked, bypass user/operator expectations, and route sensitive requests into an unrelated domain with financial-risk implications.

Self-Modification

High

Category: Rogue Agent
Content: ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: else systemctl --user disable --now team-dispatch-watch.service >/dev/null 2>&1 || true fi run rm -f "$HOME/.config/systemd/user/team-dispatch-watch.service" run systemctl --user daemon-reload say "✅ systemd service removed: team-dispatch-watch.service" }
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The overview advertises automatic DAG creation, project tracking file generation, parallel dispatch via sessions, retries, result injection, and auto-delivery without corresponding safety warnings or consent boundaries. Because these behaviors affect files, subprocesses, and other agents, describing them as automatic can normalize system-impacting actions without making the user aware of the side effects.

Session Persistence

Medium

Category: Rogue Agent
Content: cd ~/skills git clone git@github-vvusu:vvusu/team-dispatch.git # 2. Create symlink ln -s ~/skills/team-dispatch/ ~/.openclaw/skills/team-dispatch # 3. Initialize task directory
Confidence: 84% confidence
Finding: The installation instructions create a persistent symlink under the skill directory and initialize durable task storage under `~/.openclaw/workspace/tasks`. This establishes persistence across sessions/context compaction, which is core to the skill's design but also means the skill leaves state behind and can continue influencing future runs if not clearly controlled.

Static analysis

No suspicious patterns detected.