Claw Multi Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:35 AM UTC
• Version: 1.0.5

Overview

This appears to be a real multi-agent orchestration skill, but it can automatically spawn agents with broad tools, persist reports, use inherited secrets, and send results externally without enough user control.

Install only if you are comfortable with a skill that may spawn multiple OpenClaw agents, run code-capable/file-capable workflows, pass your current environment into child agent processes, save reports to disk, and potentially send results through chat or Feishu integrations. Prefer a pinned release, avoid running it with unnecessary secrets in the environment, and require explicit confirmation before file writes, external delivery, or multi-provider model comparison.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:38

Finding

Mandatory Instructions Override Host-Agent Response and Delivery Behavior

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Installation Command Executes Unpinned npm and GitHub Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: multiagent_engine.py:320

Finding

Untrusted Agent Output Is Re-Injected into Subsequent Prompts Without Isolation

Content

View full analysis

0: task.task = ( f"【前序任务输出】\n{context}\n\n" f"【当前任务】\n{task.task}" ) r = self._run_agent(task) results.append(r) ``` ```python research_summary = "\n\n".join([ f"[{r.label}] {r.output}" for r in research_results if r.success ]) if not research_summary: logger.warning("Phase 1 调研全部失败，跳过 Phase 2") return { "research_results": research_results, "draft_results": [], "stats": {"phase1_ok": 0, "phase2_ok": 0}, } logger.info(f"✍️ Phase 2: 并行生成 {num_drafts} 版草稿...") if draft_models is None: draft_models = ["default"] * num_drafts draft_tasks = [] for i in range(num_drafts): model = draft_models[i] if i < len(draft_models) else "default" task_text = draft_task_template.format(research=research_summary) draft_tasks.append(AgentTask( task=task_text, model=model, role="writer", label=f"draft_{i+1}", timeout=300, )) ``` ```python for dep in phase.get("depends_on", []): if dep in all_results: dep_output = "\n".join([ r.output for r in all_results[dep] if r.success ]) task_text = f"【前序任务输出】\n{dep_output}\n\n【当前任务】\n{task_text}" break ``` ### Technical Analysis The engine takes raw output produced by one model and directly concatenates it into the prompt sent to another model. No explicit trust boundary distinguishes prior output as inert data, and no instruction tells the receiving model to reject directives embedded in that output. Research agents may process attacker-controlled webpages, documents, repository files, or us ...[truncated 2013 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is extremely broad and includes generic English and Chinese phrases such as 'thorough analysis', 'search multiple topics', and '全面分析'. This can cause the skill to activate in many unrelated contexts, unexpectedly changing agent behavior and launching parallel workflows the user did not clearly request.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The code copies the entire parent environment into child agent subprocesses, which can expose API keys, session tokens, proxy credentials, and other sensitive runtime secrets to every spawned agent. In a multi-agent system that forwards untrusted or semi-trusted task content to separate agent processes, this significantly increases the blast radius of prompt injection, data exfiltration, or misuse by a compromised sub-agent.

Content

Scanner excerpt · multiagent_engine.py (reported line 225)May include surrounding context.

python

# model_id 为 None → 不传 --model，让 OpenClaw 用用户自己配置的默认模型
        # model_id 有值  → 透传给 CLI，使用指定模型
        env = {**os.environ}
        if model_id:
            env["OPENCLAW_AGENT_MODEL"] = model_id
            logger.info(f"[{label}] 启动 Agent (model={model_id}, thinking={task.thinking})")

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to install and execute a remote package/skill via npx --yes skills add ... without pinning a version or commit. This creates a supply-chain risk: if the referenced package, dependency chain, or fetched skill changes, users may execute unreviewed code with the same trust as the original install flow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation examples are broad natural-language phrases like '调研', '分析', and '整理成报告', which overlap heavily with ordinary user requests. In a skill-dispatch environment, this can cause unintended invocation of a powerful multi-agent workflow, potentially triggering network access, file operations, or code execution when the user did not explicitly request those capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises that sub-agents have network access, file read/write capability, and code execution, but it does not provide a user-facing warning about the associated security and privacy risks. In the context of a multi-agent orchestration skill, broad activation plus these capabilities can materially increase the blast radius of mistakes, prompt injection, or accidental data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automatic routing logic uses ambiguous signal words such as '搜索', '调研', '分析', and '写作' to select execution modes. Because these terms are common in benign conversation, the skill may over-trigger advanced behaviors or choose a more privileged mode than the user expects, increasing the chance of unintended external access or agent spawning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file prescribes an exact activation announcement in Chinese and states it must be the first reply whenever the skill is triggered. This forces a specific language regardless of the user's language preference, and no opt-in or locale-selection mechanism is offered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill mandates always writing a report file to a workspace path before delivery, regardless of whether persistence is necessary. Automatic filesystem writes create side effects, may expose sensitive task content in stored artifacts, and can overwrite files or consume storage without user approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The auto-routing section says users 'don't need to say which mode' and that the skill infers intent from broad signals like search, writing, or multiple angles. That ambiguity increases the chance of unintended activation or escalation into orchestration/hybrid modes without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

Main agent consolidates → writes full report

text

**Sequential = spawn one, wait for result, then spawn next.** Use this only when a later task depends on an earlier result (e.g. write report AFTER research is done).

**How to spawn — always include role, model hint, and what to return:**

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains its primary documentation and multiple user-facing prompts/messages in Chinese, including role prompts and execution summaries, without indicating that users may choose another language. The policy for this audit flags language/locale constraints when a skill effectively forces a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The security notes claim the module adds no new attack surface and that sub-agents inherit existing permission boundaries, but the implementation launches separate CLI subprocesses with the full current environment. That can materially change the trust boundary by exposing credentials, tokens, filesystem context, and execution capabilities to spawned agents beyond what the documentation suggests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · multiagent_engine.py (reported line 235)May include surrounding context.

python

start_time = time.time()

        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file uses Chinese-only natural-language descriptions, help text, and example invocations, which effectively imposes a specific language/locale on users. The file does not offer an opt-in choice of language or explain that the skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring and all user-facing descriptions are written only in Chinese, presenting the router as a general-purpose task router without indicating that it is Chinese-specific or offering a language choice. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The exception handlers reference sys.stderr and sys.exit, but sys is only imported inside the main block after function definitions. If this module is imported and main() is invoked programmatically rather than through the main path, an exception in main() will trigger a NameError in the error-handling path, suppressing the intended error reporting and causing unreliable failure behavior. In this skill context, that mainly creates a denial-of-service/reliability issue rather than direct code execution or data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill name, description, roles, and task prompts are entirely written in Chinese, which effectively constrains use to a specific language. There is no indication that the user can choose another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sends the full user prompt to four separate external model providers (kimi, claude, gemini, glm) for comparison, but the template contains no user-facing notice, consent step, or data-minimization control. This creates a real privacy and data-governance risk because sensitive prompts may be disclosed to multiple third parties, increasing exposure surface and complicating compliance, retention, and cross-border processing concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill name and description are written only in Chinese, and the tasks throughout the manifest also prescribe Chinese-language behavior without offering any user opt-in or locale selection. This creates a natural-language locale policy issue because the skill appears to enforce a specific language rather than letting the user choose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document says to always end with a specific Chinese sentence asking about adjustments or Feishu delivery. This is another hard-coded language requirement that may conflict with organizational language or locale expectations when users interact in other languages.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file states that path validation is the orchestrating agent's responsibility, but this module does not enforce or verify that assumption before forwarding task content to child agents. In a multi-agent orchestration context, relying only on upstream validation makes misuse easier and increases the chance of unsafe file access if a caller is compromised or mistaken.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The visible natural-language metadata is only in Chinese, which can impose a language choice on users without opt-in. The file does not indicate that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.