Claw Orchestrator - CC+WBClaw多Agent协作

• Outcome: Review
• Latest audit: May 28, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed automation helper, but it runs a write-capable agent with bypassed permissions and unsafe command construction that can modify local files without enough user control.

Install only if you intentionally want a local orchestrator that can let another agent read and write files in the configured workspace. Review and change the hard-coded paths first, run it only in a disposable or version-controlled directory, avoid untrusted task text, and treat bypassPermissions as elevated access that can change local files without normal prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["PATH"] = os.path.dirname(NODE) + ";" + env.get("PATH", "")
    
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=180, cwd=WORKDIR, 
                       env=env, encoding="utf-8", errors="replace")
    t1 = time.time()

• Confidence: 98% confidence
• Finding: r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=180, cwd=WORKDIR, env=env, encoding="utf-8", errors="replace")

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands and enables file read/write behavior but does not declare corresponding permissions or guardrails. This creates a mismatch between documented behavior and expected security boundaries, making it easier for a caller or downstream agent to perform higher-risk actions without transparent consent or policy review.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The documentation explicitly instructs use of `--permission-mode bypassPermissions`, which disables normal permission protections for the downstream agent. In an orchestration skill that forwards user tasks to another agent, this materially increases the risk that prompt injection, ambiguous requests, or unsafe task content will lead directly to unauthorized file modification or broader system actions.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The skill directs a downstream agent to use write-capable tools to create arbitrary files based on task input. While file generation is part of the intended functionality, allowing unconstrained writes from analyzed user requests is dangerous because a malicious or malformed prompt could cause overwriting of important files, creation of deceptive artifacts, or persistence of unsafe content.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The orchestrator launches Claude Code with `Read,Write` tools and `--permission-mode bypassPermissions`, explicitly allowing autonomous file modification with no approval gate. In this skill context, the agent is fed raw user tasks and told to 'write the files NOW', so prompt injection or unsafe user requests can directly alter local project files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow states that files, reports, and memory/log artifacts will be written automatically, but it does not prominently warn users that running the skill modifies local state. Silent or implicit persistence increases the chance of unintended data corruption, disclosure in shared logs, and retention of sensitive task material in `MEMORY.md` or daily logs.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation combines elevated permission bypass with write-capable execution while omitting a clear warning that the workflow overrides normal safety checks. This is especially dangerous in an orchestrator because it encourages operators to adopt an unsafe default pattern, reducing friction for destructive or unauthorized changes triggered by downstream agent behavior.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code gives an external agent write capability with permission checks bypassed and no explicit confirmation to the user before filesystem changes occur. In an orchestration skill, this makes accidental or malicious task phrasing much more dangerous because destructive file writes can happen automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.