Team Resurrection

• Outcome: Review
• Latest audit: May 28, 2026 · 2:17 AM UTC
• Version: 1.1.2

Overview

This skill mostly matches its migration and cloning purpose, but it handles very sensitive agent state and can import persistent scheduled tasks with under-scoped review controls.

Install only if you intend to migrate or clone a full OpenClaw agent environment. Run migrate.py with --dry-run first, inspect the ZIP contents and cron_tasks.json in full, prefer --no-cron until you trust every scheduled payload, and treat generated migration packages as secrets because they may contain memories, API keys, account details, prompts, and workspace configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def info(msg):  print(f"{BLUE}[i]{NC} {msg}")

def run_cmd(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout.strip(), result.returncode

# =============================================

• Confidence: 98% confidence
• Finding: run_cmd executes a string with shell=True, which is dangerous because any caller that passes package-controlled or user-influenced text can trigger shell metacharacter interpretation and command injection. In this file it is currently used with a constant command, but the helper is generic and the unsafe primitive remains present in a migration tool that processes untrusted package contents.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description understates the full behavior: beyond backup/migration, it also modifies agent trust boundaries, creates persistence via cron, copies highly sensitive memory/credential files, can overwrite or repoint the main agent, and restarts the gateway. This mismatch can cause users to consent to operations with greater security and operational impact than they reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The changelog advertises a 'clone/resurrection' capability that materially exceeds the declared packaging/migration purpose in the metadata. That kind of scope mismatch is dangerous because it can conceal persistence, session takeover, or unauthorized state recovery features behind a benign description, reducing user scrutiny and informed consent.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: Presenting resurrection/clone behavior as the core feature while the manifest frames the skill as team packaging/migration creates a deceptive trust boundary. Even if not overtly malicious, this discrepancy can cause operators to install or run a skill with capabilities they did not expect, increasing the chance of misuse or unsafe execution.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The cron template defines an unattended agent task that reads local state, updates repository content, and performs commit/push actions on a daily schedule. For a skill whose stated purpose is team migration/packaging, embedding autonomous repository-changing behavior creates a significant integrity risk and can propagate unintended or harmful changes to remotes without fresh user approval.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The file describes itself as a generic cron template, but the actual task is a specific self-improvement workflow that modifies and pushes repository state. This mismatch increases the chance that users or reviewers will consent to installation under false assumptions, enabling stealthy persistence and unintended code or content changes.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The migration script does more than copy team configuration: it imports and activates cron tasks from package contents, allowing persistent scheduled actions to be installed from an untrusted migration bundle. That materially expands the trust boundary and can turn a one-time migration into long-lived code or action execution on the host.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: Restarting the local gateway changes system state beyond simple file migration and can immediately activate newly imported configuration or tasks. In a tool that consumes untrusted package contents, automatic service restart increases the chance that unsafe changes take effect without giving the operator time for independent review.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Creating scheduled jobs from package data is a powerful capability not tightly aligned with a migration tool's stated purpose, and it introduces persistence controlled by the package author. Even with a review prompt, only a truncated payload is shown, so harmful job content may be hidden from the user while still being installed.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exports cron task definitions and payloads into the migration package, expanding collection beyond the described team/workspace packaging scope. Cron payloads can contain operational logic, prompts, secrets, or sensitive context, so silently bundling them increases data exposure risk during transfer or reuse.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script enumerates common directories under the user's home directory and records detected git work directories in the package, even though this behavior is outside the stated packaging scope. This leaks repository locations and project structure metadata that may reveal confidential client, product, or organizational information.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The generated README claims safeguards such as showing all changes for confirmation and supporting fine-grained controls, but this packer does not implement or verify those protections. Misrepresenting safety controls can cause users to trust and share sensitive migration bundles under false assumptions, increasing the chance of unsafe downstream automation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly instructs packaging identity files, memory, user information, tools configuration, agent rosters, skills, and cron/config artifacts, but it does not clearly warn that these may contain sensitive personal data, credentials, IDs, behavioral history, or internal operational details. In a migration skill, this omission is risky because users may create and transfer archives containing highly sensitive material without informed consent, increasing the chance of unintended disclosure or insecure handling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The migration flow performs privileged and potentially disruptive actions—copying files into agent workspaces, updating configuration, creating cron tasks, and restarting the gateway—yet the documentation does not present a consolidated risk notice describing operational, persistence, and availability consequences. This matters because users may run the migration with incomplete understanding of system-wide effects, leading to accidental service interruption, unintended persistence, or unsafe deployment of imported content.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are broad everyday requests like '我要搬家' or '备份团队', which can activate a skill that performs powerful filesystem, config, cron, and restart actions without sufficiently narrow scope checks. In a high-privilege migration skill, ambiguous triggering increases the risk of accidental invocation and unintended destructive or sensitive operations.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The template sets a broad recurring trigger with an underspecified target context, causing a generic migration skill to install persistent automation whose operational scope is not tightly bounded. Overbroad scheduling increases the risk of repeated unintended actions, especially when the payload includes repository modification and remote synchronization behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script copies core identity and memory files, including files explicitly noted as possibly containing private data or API keys, into a portable archive without an upfront consent checkpoint. In this context, the tool is designed for easy migration, so accidental over-collection and exfiltration of highly sensitive agent data is a realistic risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes agent configuration and cron task payloads into package files without clearly warning that these outputs may embed sensitive configuration, prompts, routing data, or tokens. Because the package is intended to be handed to another agent or moved to another machine, undisclosed sensitive exports materially increase exposure risk.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The README instructs users to hand the produced package to an agent for automatic migration of identity, memory, tools, team, and task data. This encourages automated processing of a highly sensitive bundle by another agent, which can lead to over-trust, unintended execution of bundled content, or disclosure of confidential state across environments.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**解决：** 换一个后缀，或手动删除旧分身：
```bash
rm -rf ~/.qclaw/workspace-xxx-旧后缀
# 然后从 openclaw.json 中删除对应 agent 条目
```

• Confidence: 73% confidence
• Finding: This finding appears to derive from the analyzer recognizing a potentially dangerous deletion pattern and overgeneralizing it to `rm -rf ~/.qclaw/`. The literal text shown in the skill is more limited, but the risk remains real because the documented command pattern is hazardous and could be expanded or misapplied to the entire application directory by a user or agent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**解决：** 换一个后缀，或手动删除旧分身：
```bash
rm -rf ~/.qclaw/workspace-xxx-旧后缀
# 然后从 openclaw.json 中删除对应 agent 条目
```

• Confidence: 73% confidence
• Finding: This finding appears to derive from the analyzer recognizing a potentially dangerous deletion pattern and overgeneralizing it to `rm -rf ~/.qclaw/`. The literal text shown in the skill is more limited, but the risk remains real because the documented command pattern is hazardous and could be expanded or misapplied to the entire application directory by a user or agent.

Static analysis

No suspicious patterns detected.