Security audit

Workhorse Duo

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate two-agent workflow, but its setup can broaden local agent access and session visibility more than the two-worker use case requires.

Install only if you want a real local multi-agent workflow. Before running AutoFixConfig, inspect the helper and understand it may expose more sessions and agents than necessary. After validation, replace the wildcard allow policy with only the intended agents, reduce session visibility where possible, and keep or verify the backup before using this with private or high-impact work.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The AutoFixConfig path modifies ~/.openclaw/openclaw.json to enable agent-to-agent access and sets allow = ["*"], which grants broad cross-agent permissions far beyond the two named workers. In a multi-agent environment, this weakens isolation and can let any allowed agent interact with others or observe sessions, increasing the blast radius if any agent is compromised or misused.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The skill explicitly instructs operators to use an auto-fix flow that patches cross-agent configuration and restarts the gateway, but it does not require an explicit warning, confirmation step, or rollback-first prompt before making system-affecting changes. In an orchestration skill, this is risky because users may trigger environment mutations that alter trust boundaries or service availability without fully understanding the operational impact.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The bootstrap guidance explicitly sets `agentToAgent.allow` to `["*"]`, granting unrestricted cross-agent access during setup. In a skill whose purpose is multi-agent orchestration, this materially expands trust boundaries and can let any agent invoke or interact with any other agent/session, increasing the blast radius if one agent is compromised or misconfigured.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The markdown presents the helper as a practical bootstrap path without an upfront warning that AutoFixConfig edits local security configuration, enables cross-agent features, sets permissive policy, writes backups, and restarts the gateway. That omission can cause operators to run the helper without understanding they are weakening local security controls, which is especially risky in a skill explicitly designed for multi-agent orchestration.

Static analysis

No suspicious patterns detected.