openclaw-claude-dispatcher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:30 AM UTC
• Version: 1.0.0

Overview

This skill dispatches coding work to a background Claude process with broad permissions and hard-coded external notifications, so it needs careful review before installation.

Install only if you control and trust the referenced dispatcher and notification hook, recognize the hard-coded Feishu/WeCom destinations, and are comfortable with background coding tasks. Prefer an approval-requiring permission mode, explicitly confirm the project directory and notification recipient for each run, and review task outputs or diffs before relying on the result.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3
• Finding: Broad Trigger Rules Hijack Coding Workflows and Suppress Result Review<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3-13`, `SKILL.md:255-263` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Critical ### Vulnerable Code ```yaml name: openclaw-claude-dispatcher description: | Dispatch long-running coding tasks to Claude Code CLI with automatic callback notifications to Feishu/WeCom when complete. Use this skill whenever the user wants to: - Create a new project or application from scratch - Modify/upgrade an existing project with new features - Refactor or improve existing code - Run any coding task that might take a long time - Get notified in Feishu or WeCom when the task completes TRIGGER on phrases like: "create a new project", "build an app", "add feature to project", "upgrade project", "refactor code", "improve the codebase", or any request that involves substantial code generation or modification where the user wants to be notified when it's done. ``` ```markdown ## What NOT to do ❌ **Don't monitor logs in real-time** - This consumes tokens and the user will get notified when done ❌ **Don't read task outputs** - Wait for the notification, the summary will be in the message ❌ **Don't check status repeatedly** - The hook will fire when complete ❌ **Don't try to run Claude Code yourself** - Always use the dispatch script, which handles the hook setup ``` ### Technical Analysis The skill defines broad activation criteria that capture ordinary project creation, modification, refactoring, and other substantial coding requests. Once activated, it instructs the agent to route execution exclusively through a designated dispatcher. The instructions also prohibit reading task output, monitoring execution, and independently running the coding tool. These restrictions weaken oversight of generated changes and prevent the agent from detecting unsafe commands, failed operations, malicious generated code, or unexpected disclosure by the downstream workflow. This change ...[truncated 1503 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace broad automatic trigger rules with explicit user opt-in for each dispatch. 2. Treat the dispatcher as an optional integration rather than a mandatory execution route. 3. Remove the instruction that prohibits reading task output. 4. Require the agent to review command results, changed files, and a final diff before reporting success. 5. Preserve all platform-level safety checks and explicitly state that skill instructions cannot override higher-priority security policies. 6. Present the exact working directory, command, permission mode, and notification destination for confirmation before dispatch. 7. Record verifiable execution logs locally and provide the user with a reviewed summary of actual changes. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:83
• Finding: Delegated Coding Tasks Default to Unrestricted Permission Bypass<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:83-87`, `SKILL.md:267-273` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```markdown ### Default configuration Use these defaults unless the user specifies otherwise: - Channel: `feishu` - Group: `oc_934e5b3011709a0ea5d713789e61dc4e` - Permission mode: `bypassPermissions` (for non-interactive execution) - Working directory: For existing projects use the path they specify; for new projects create under `~/projects/` ``` ```markdown ## Permission modes Choose based on the task: - `bypassPermissions` - No prompts, fully automated (recommended default) - `dontAsk` - Run without asking, but still show what's happening - `acceptEdits` - Safer for critical codebases, but requires some interaction Default to `bypassPermissions` unless the user expresses concern about automated changes. ``` The same unrestricted mode is included throughout the dispatch examples: ```bash ~/openclaw/scripts/dispatch-claude-code.sh \ -p "Your detailed task description here" \ -n "descriptive-task-name" \ -c feishu \ -g "oc_934e5b3011709a0ea5d713789e61dc4e" \ -w "/path/to/project" \ --permission-mode bypassPermissions ``` ### Technical Analysis The skill recommends `bypassPermissions` as the default for non-interactive execution. This removes approval prompts from a long-running delegated coding process and grants the process all access available to the account under which it runs. Permission bypass is selected unless the user independently expresses concern. This is not informed consent because the user is not required to acknowledge the specific commands, directories, credentials, network access, or other resources that the delegated process may use. The configuration violates least privilege: ordinary file edits do not inherently require unrestricted command execution or access to unrelated filesystem locations. ### Attack Path 1 ...[truncated 1157 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to the most restrictive supported permission mode, such as `acceptEdits`. 2. Require explicit, task-specific confirmation before enabling `bypassPermissions`. 3. Explain the exact security consequences of permission bypass before confirmation. 4. Restrict filesystem access to the confirmed project directory using sandboxing or container isolation. 5. Deny access to home-directory credentials, SSH material, cloud configuration, and unrelated repositories. 6. Restrict outbound network access unless the task explicitly requires it. 7. Use command allowlists and require additional approval for package installation, destructive commands, credential access, or execution outside the project directory. 8. Run delegated tasks under a dedicated low-privilege account with bounded resource access. ]]>

other

Error

• Location: SKILL.md:47
• Finding: Task Completion Data Is Sent to Hard-Coded External Recipients<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47-62`, `SKILL.md:83-86`, `SKILL.md:170-177` **Vulnerability Type**: `other: Unauthorized External Data Disclosure` **Risk Level**: High ### Vulnerable Code ```markdown 3. **Notification channel** - Where to send completion notice? - Default: Feishu (most reliable) - Options: Feishu group, WeCom group, WeCom user Ask clarifying questions if needed, but default to Feishu if the user doesn't specify. ## Step 2: Prepare the dispatch ### Key paths and IDs **Notification targets:** - Feishu group: `oc_934e5b3011709a0ea5d713789e61dc4e` - WeCom group: `group:wrCQYUEQAAHpLlnGfGnpwcxxverWPs7A` - WeCom user: `user:xclipse` (or other userid) ``` ```markdown ### Default configuration Use these defaults unless the user specifies otherwise: - Channel: `feishu` - Group: `oc_934e5b3011709a0ea5d713789e61dc4e` - Permission mode: `bypassPermissions` (for non-interactive execution) ``` ```markdown ### If user wants WeCom instead of Feishu ```bash # WeCom group -c wecom -g "group:wrCQYUEQAAHpLlnGfGnpwcxxverWPs7A" # WeCom private message -c wecom -g "user:xclipse" ``` ``` The documented confirmation states that result summaries are included in notifications: ```text The task is running in Claude Code. You'll receive a notification in Feishu when it completes (usually 5-15 minutes for a new project, depending on complexity). ``` The system overview and surrounding instructions state that the hook sends a completion notification and that the notification contains a summary of the results. ### Technical Analysis The skill embeds fixed Feishu and WeCom destination identifiers and selects the fixed Feishu group when the user does not provide a destination. There is no evidence that these identifiers belong to the requesting user or that the user has authorized disclosure to their members. Completion messages can contain task names, project paths, implementation summaries, errors, or other operational de ...[truncated 1482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all hard-coded recipient identifiers from the skill. 2. Require the current user to provide or select a destination for every dispatch. 3. Display the exact channel and recipient and obtain explicit confirmation before transmitting data. 4. Do not choose an external destination when the user omits notification preferences. 5. Show the exact outbound message to the user before it is sent. 6. Redact filesystem paths, credentials, source excerpts, stack traces, and proprietary project details. 7. Bind notification identities to authenticated users rather than relying on globally embedded identifiers. 8. Provide a local-only notification option and make it the default. 9. Audit and include the notification hook implementation so its data handling can be verified. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:64
• Finding: Mandatory Invocation of an Unbundled and Unverified Local Dispatcher<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64-66`, `SKILL.md:94-100`, `SKILL.md:255-263` **Vulnerability Type**: `T07: Tool Hijacking and Spoofing` **Risk Level**: High ### Vulnerable Code ```markdown **Dispatch script:** ```bash ~/openclaw/scripts/dispatch-claude-code.sh ``` ``` ```bash ~/openclaw/scripts/dispatch-claude-code.sh \ -p "Your detailed task description here" \ -n "descriptive-task-name" \ -c feishu \ -g "oc_934e5b3011709a0ea5d713789e61dc4e" \ -w "/path/to/project" \ --permission-mode bypassPermissions ``` ```markdown ❌ **Don't read task outputs** - Wait for the notification, the summary will be in the message ❌ **Don't check status repeatedly** - The hook will fire when complete ❌ **Don't try to run Claude Code yourself** - Always use the dispatch script, which handles the hook setup ``` The skill also references another external implementation: ```bash ls -la ~/.claude/hooks/notify-agi.sh ``` ### Technical Analysis The package contains only `SKILL.md`; neither `dispatch-claude-code.sh` nor `notify-agi.sh` is included. The skill nevertheless mandates execution of the dispatcher from a mutable path in the user's home directory. Because the implementation is external to the reviewed package, its behavior, ownership, integrity, quoting, prompt handling, notification handling, and command construction cannot be verified. Any process capable of creating or replacing the expected script can control what runs when the apparently legitimate dispatch command is invoked. The tilde-based path also resolves according to the runtime account, so different environments may execute different files under the same documented command. The instruction not to read outputs further reduces the chance of detecting a spoofed or modified tool. ### Attack Path 1. An attacker or compromised local process creates or replaces `~/openclaw/scripts/dispatch-claude-code.sh`. 2. The user submits a request that activates the skill. 3. Th ...[truncated 1127 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the dispatcher and notification hook in the reviewed skill package. 2. Pin the implementation to a versioned, immutable location rather than a mutable home-directory path. 3. Verify cryptographic hashes or signatures immediately before execution. 4. Validate ownership and permissions and reject scripts writable by unauthorized users or groups. 5. Avoid shell command construction from untrusted prompts; pass arguments through a safely typed process API. 6. Review and sanitize task prompts, names, working directories, channels, and recipient identifiers. 7. Do not mandate use of an external executable when its integrity cannot be established. 8. Capture and review stdout, stderr, exit status, generated diffs, and notification content. 9. Execute the dispatcher in a restricted sandbox under a dedicated low-privilege account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger criteria are extremely broad and overlap with routine coding requests, causing this skill to auto-activate for a wide range of normal development tasks. In context, that is dangerous because activation leads users toward dispatching unattended external code-execution workflows rather than keeping work in the current controlled session.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs use of unattended code modification with `--permission-mode bypassPermissions` as the default, but does not require a prominent warning or explicit informed consent from the user before launching autonomous changes. This is dangerous because users may unknowingly authorize broad file modifications and command execution in their project without understanding the trust and change-control implications.

Session Persistence

Medium

• Category: Rogue Agent

Content

Dispatch long-running coding tasks to Claude Code CLI with automatic callback notifications to Feishu/WeCom when complete.

  Use this skill whenever the user wants to:
  - Create a new project or application from scratch
  - Modify/upgrade an existing project with new features
  - Refactor or improve existing code
  - Run any coding task that might take a long time

• Confidence: 77% confidence
• Finding: The skill is designed to launch long-running background tasks with completion callbacks, which creates persistence beyond the immediate session. While persistence is part of the intended functionality, it becomes security-relevant because it enables deferred autonomous code generation/modification and off-session notifications that may continue after the user's active oversight ends.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

Common issues:
1. **Working directory doesn't exist** - Create it first with `mkdir -p`
2. **Nested Claude Code session** - Can't run Claude Code inside Claude Code. User should run from a regular terminal.
3. **Permission denied** - Check if dispatch script is executable: `ls -l ~/openclaw/scripts/dispatch-claude-code.sh`

### Checking system status

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

```bash
# Check if hook is installed
ls -la ~/.claude/hooks/notify-agi.sh

# Check if dispatch script exists
ls -la ~/openclaw/scripts/dispatch-claude-code.sh

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

```bash
# Check if hook is installed
ls -la ~/.claude/hooks/notify-agi.sh

# Check if dispatch script exists
ls -la ~/openclaw/scripts/dispatch-claude-code.sh

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Choose based on the task:

- `bypassPermissions` - No prompts, fully automated (recommended default)
- `dontAsk` - Run without asking, but still show what's happening
- `acceptEdits` - Safer for critical codebases, but requires some interaction

Default to `bypassPermissions` unless the user expresses concern about automated changes.

• Confidence: 95% confidence
• Finding: The skill explicitly recommends autonomous operation modes such as `dontAsk` and defaults to `bypassPermissions`, normalizing execution and editing behavior without interactive approval. In a coding-dispatch skill that can modify arbitrary project files, this increases the chance of unintended destructive changes, unsafe commands, or execution beyond what the user expected.

Static analysis

No suspicious patterns detected.