T06 · System Persistence
Error
- Location
scripts/setup.sh:422- Finding
Default Installation Creates a Persistent Background Watcher
- Content
View full analysis
- Remediation
View remediation
Security audit
Team Dispatch
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly fits multi-agent orchestration, but its default setup adds persistent background jobs and broad agent delegation that should be reviewed before installation.
Install only if you are comfortable with this skill changing OpenClaw configuration, granting broad subagent delegation, and creating recurring background jobs. Before running setup, consider setting watcher.enabled=false and dailySummary.enabled=false or using --no-watch, and narrow allowAgents to the intended team roster.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
scripts/setup.sh:490- Finding
Setup Registers a Daily Autonomous Main-Agent Job by Default
- Content
View full analysis
/dev/null | node -e "let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{try{const j=JSON.parse(s);process.stdout.write(j.jobId||j.id||'');}catch(e){process.stdout.write('');}});") ``` The installation is skipped only when explicitly disabled: ```bash if [ "$ERRORS" -ne 0 ]; then echo " ⏭️ 安装存在错误，跳过每日总结任务" elif ! command -v openclaw >/dev/null 2>&1; then echo " ⏭️ 未找到 openclaw，跳过每日总结任务" elif [ "$DAILY_SUMMARY_ENABLED" = "0" ]; then echo " ⏭️ config.json 中 dailySummary.enabled=false，跳过" else echo " ▶︎ cron='$DAILY_SUMMARY_CRON'${DAILY_SUMMARY_TZ:+ tz=$DAILY_SUMMARY_TZ}" install_daily_summary_job "$SKILL_DIR" "$DAILY_SUMMARY_NAME" "$DAILY_SUMMARY_CRON" "$DAILY_SUMMARY_TZ" "$DAILY_SUMMARY_DESC" fi ``` ### Technical Analysis The setup registers an OpenClaw cron task that starts an i ...[truncated 1805 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/watch-install.sh:239- Finding
Unvalidated Watcher Configuration Is Injected into Scheduler Definitions
- Content
View full analysis
"$SERVICE_DST" <- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/setup.sh:215- Finding
Setup Grants the Main Agent Wildcard Delegation Authority
- Content
View full analysis
a.id === 'main'); if (idx === -1) { config.agents.list.unshift(mainAgentPatch); console.log(' ✅ main → 新增（dispatcher/root）'); } else { const existing = config.agents.list[idx]; existing.subagents ??= {}; if (!Array.isArray(existing.subagents.allowAgents) || existing.subagents.allowAgents.length === 0) { existing.subagents.allowAgents = ['*']; console.log(' 🔧 main → 设置 subagents.allowAgents=["*"]'); } } ``` The documented configuration explicitly requires the wildcard: ```json { "id": "main", "default": true, "name": "main", "workspace": "/Users/vvusu/.openclaw/workspace", "agentDir": "/Users/vvusu/.openclaw/agents/main/agent", "model": "openai-codex/gpt-5.4", "identity": { "name": "调度台", "emoji": "🎯" }, "subagents": { "allowAgents": ["*"] } } ``` ### Technical Analysis The Skill has a finite configured roster of worker agents, so orchestration only requires authority to launch those specific IDs. Granting `allowAgents: ["*"]` permits the dispatcher to invoke all current and future agents known to OpenClaw, including agents unrelated to Team Dispatch. This weakens the system's least-privilege boundary. If a malicious project description, c ...[truncated 1522 chars]- Remediation
View remediation
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (148)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The periodic watch/reconciliation loop adds autonomous monitoring behavior that is not obvious from the top-level orchestration description. Even if intended for reliability, unattended execution changes the trust model and can create ongoing resource use or repeated actions without fresh user approval.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 96% confidence
- Finding
The prompt builder directly injects upstream task results into downstream prompts without sanitization, delimiting, or trust separation. If an upstream result contains prompt-injection content or malicious instructions, it can manipulate downstream agents, causing privilege confusion, unsafe actions, or data leakage across task boundaries.
- Content
for depId in task.dependsOn: dep = findTask(depId) prompt += "\n\n[{dep.id}] ({dep.agentId}): {dep.result}" return prompt
text ### Step 4: 并行派发注意事项
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scripts/doctor.sh` | 环境健康检查 | `bash <SKILL_DIR>/scripts/doctor.sh` |
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file defines a domain-specific research analyst agent, while the skill metadata says this skill is for multi-agent workflow orchestration. This mismatch is dangerous because the wrong instructions can cause the system to invoke or configure an agent with capabilities and constraints unrelated to orchestration, leading to incorrect task routing, broken isolation assumptions, and unsafe cross-agent behavior in a dispatcher context.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This bootstrap file is materially misaligned with the declared purpose of the skill. Instead of multi-agent workflow orchestration, it instructs identity construction, user profiling, memory creation, and optional messaging onboarding, which expands the skill's behavioral scope and can cause an agent to perform unauthorized data collection or account-linking tasks under a misleading label.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file clearly redefines the
team-dispatchskill as a dedicated security-audit agent instead of a multi-agent orchestration skill, which is a scope-confusion and policy-integrity issue. In an agent framework, this can cause incorrect routing, privilege misuse, or execution under false assumptions about the skill’s purpose, especially if callers trust the metadata and invoke it for orchestration behavior that it does not implement.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This bootstrap file is materially misaligned with the declared purpose of a team-dispatch orchestration skill. Instead of task decomposition and workflow coordination, it redirects the agent into persona formation, user profiling, persistent memory creation, and optional external account onboarding, which expands capability and data access beyond what users would reasonably expect.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file's behavior is materially misaligned with the stated purpose of the 'team-dispatch' skill. Instead of orchestrating multi-agent workflows, it performs persona bootstrapping, persistent memory setup, and onboarding to external chat channels, which can cause the agent to take actions outside expected scope and collect/store unnecessary personal data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file content does not match the declared skill purpose: instead of multi-agent workflow orchestration, it defines a trading-agent persona and operating guidance. This kind of skill/manifest mismatch is dangerous because it can cause the wrong capability to be invoked, bypass user/operator expectations, and route sensitive requests into an unrelated domain with financial-risk implications.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh else systemctl --user disable --now team-dispatch-watch.service >/dev/null 2>&1 || true fi run rm -f "$HOME/.config/systemd/user/team-dispatch-watch.service" run systemctl --user daemon-reload say "✅ systemd service removed: team-dispatch-watch.service" }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The overview advertises automatic DAG creation, project tracking file generation, parallel dispatch via sessions, retries, result injection, and auto-delivery without corresponding safety warnings or consent boundaries. Because these behaviors affect files, subprocesses, and other agents, describing them as automatic can normalize system-impacting actions without making the user aware of the side effects.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The installation instructions create a persistent symlink under the skill directory and initialize durable task storage under
~/.openclaw/workspace/tasks. This establishes persistence across sessions/context compaction, which is core to the skill's design but also means the skill leaves state behind and can continue influencing future runs if not clearly controlled.- Content
md cd ~/skills git clone git@github-vvusu:vvusu/team-dispatch.git # 2. Create symlink ln -s ~/skills/team-dispatch/ ~/.openclaw/skills/team-dispatch # 3. Initialize task directory