ClawHub
Back to skill

Security audit

clawteam-skill

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is purpose-aligned for multi-agent coordination and discloses its high-impact behavior, but users should treat the external CLI and spawned agents carefully.

Install only if you intentionally want ClawTeam-style multi-agent orchestration. Verify and pin the external clawteam CLI before installing it, use it in trusted repositories, keep permission prompts enabled, and review any subprocess spawn, branch merge, forced cleanup, or web dashboard exposure before approving it. Do not place secrets in tasks, worktrees, or messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
git worktree isolation + tmux + filesystem-based messaging. Trigger phrases: team, swarm, multi-agent, clawteam, spawn agents, parallel agents, agent team."
homepage: https://github.com/win4r/ClawTeam-OpenClaw
metadata:
  openclaw:
    requires:
      bins: ["clawteam"]
---

# ClawTeam — Multi-Agent Swarm Coordination

## Overview

ClawTeam is a CLI tool (`clawteam`) for orchestrating multiple AI agents as self-organizing swarms. It uses git worktree isolation, tmux windows, and filesystem-based messaging. OpenClaw is the default agent backend.
Source: https://github.com/win4r/ClawTeam-OpenClaw

## Optimization Notes

This skill is based on the upstream ClawTeam project and includes additional safety/approval optimizations for real-world operations:

- Channel-aware approval UX:
  - Feishu uses interactive approval cards with same-row `Approve/Reject` buttons.
  - Telegram uses inline keyboard approval buttons.
  - Other channels fall back to explicit text approval (`approve` / `rej

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

md
## Safety Guardrails

- Never bypass security, trust, or permission prompts.
- Never run infinite unattended loops; use bounded retries/timeouts.
- Ask for user confirmation before destructive actions (force cleanup, branch merge, mass task updates).
- If a command requests elevated privileges or modifies sensitive paths, pause and ask first.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are very broad and overlap with common user language such as 'team', 'swarm', and 'parallel agents'. That can cause the skill to auto-activate in contexts the user did not intend, increasing the chance of launching high-impact orchestration actions or exposing users to risky commands unnecessarily.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The skill explicitly documents modes like 'spawn subprocess' and custom backends that can execute arbitrary delegated commands. In an agent skill context, spawning multiple agents in tmux/worktrees materially expands execution surface and can turn prompt-driven tasking into uncontrolled code execution if used in untrusted repos or with unsafe tasks.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

clawteam spawn -t -n --task "" --workspace --repo /path/to/repo

text

High-impact note: `spawn subprocess` and custom backend modes can execute arbitrary code through delegated commands. Use only in trusted repositories/environments.

Each spawned agent gets:
- Its own tmux window (visible via `board attach`)

Static analysis

No suspicious patterns detected.