Team Sessions

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.2

Overview

This skill is openly about delegating work to subagents, but its default setup grants broad subagent spawning and changes persistent OpenClaw configuration in ways users should review carefully.

Install only if you intentionally want a multi-agent delegation workflow. Before using it, replace allowAgents ["*"] with a small explicit list of approved agent IDs, review each subagent workspace and SOUL.md, avoid sending secrets or private code to unnecessary subagents, and document how to undo the openclaw.json change and remove persistent workspaces.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:206

Finding

Global Primary-Agent Behavior Override

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 206–210
Vulnerability Type: Agent instruction hijacking
Risk Level: High

Relevant source excerpt translated into English:

markdown

### 4. The primary agent does not execute

- For anything that needs to be done, the first response must be: "Who should this be assigned to?"
- Do not write code, modify files, or execute scripts directly.

Technical Analysis

The Skill establishes mandatory, session-wide rules that replace the primary agent's normal task-execution behavior. These instructions are not scoped to an explicit team-orchestration request. Instead, they direct the agent to delegate every actionable operation and prohibit it from writing code, modifying files, or running scripts itself.

This behavior exceeds what is necessary to provide optional multi-agent coordination. When the Skill is loaded, unrelated user requests can be redirected to subagents even when delegation was not requested or when direct execution would be safer. Delegation also introduces additional trust boundaries because task instructions, user-provided content, and potentially sensitive context may be transferred into another agent session and workspace.

Attack Path

1. The Team Sessions Skill is loaded into the primary agent's context.
2. The mandatory rule requiring delegation of every actionable task becomes active.
3. A user submits an ordinary task involving code, files, scripts, or another action.
4. Rather than executing the task under the primary agent's established controls, the agent selects and spawns a subagent.
5. The delegated task and associated context enter the subagent's session and workspace.
6. Instructions in the selected agent's persona or workspace can influence execution, potentially causing behavior that the user did not request or authorize.

Impact Assessment

Exploitation can redirect tasks away from the primary agent and ...[truncated 475 chars]

Remediation

View remediation

Remediation Suggestions

• Scope delegation behavior to user requests that explicitly ask for team or multi-agent orchestration.
• Replace mandatory global language with an optional recommendation, such as: "When the user requests delegation, select an approved subagent for the specified task."
• Allow the primary agent to perform tasks directly when delegation is unnecessary or would expand the trust boundary.
• Require explicit user confirmation before delegating sensitive data, credentials, private source code, or privileged operations.
• Ensure delegated task packages contain only the minimum context required by the selected subagent.
• Define conditions under which delegation must not occur, including unknown agent identities, untrusted workspaces, or tasks involving sensitive system access.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:78

Finding

Wildcard Subagent Authorization Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78–100
Additional Location: README.md, lines 9–12 and 45–64
Vulnerability Type: Overly broad access-control configuration
Risk Level: Medium

Vulnerable configuration:

json

{
  "agents": {
    "defaults": {
      "subagents": {
        "allowAgents": ["*"]
      }
    },
    "list": {
      "member-a": {
        "agentId": "member-a",
        "workspace": "~/.qclaw/workspace-main/member-a"
      },
      "member-b": {
        "agentId": "member-b",
        "workspace": "~/.qclaw/workspace-main/member-b"
      }
    }
  }
}

Technical Analysis

The documented default configuration uses allowAgents: ["*"], authorizing the primary agent to spawn every available agent identity rather than only the two agents required by the example. The accompanying documentation presents explicit allowlisting as optional and minimizes the security significance of the wildcard.

Although wildcard authorization does not necessarily grant every subagent identical system privileges, it broadens the set of agent identities that can be selected for delegated work. Agent identities may have separate personas, workspaces, instructions, tools, or permissions. Consequently, the wildcard causes future or otherwise unrelated agent definitions to enter the authorization boundary automatically.

This configuration becomes more significant when combined with the Skill's mandatory delegation behavior: an injected instruction, mistaken identifier, or compromised task may cause the primary agent to select an unintended but wildcard-authorized agent.

Attack Path

1. A user copies the documented configuration into ~/.qclaw/openclaw.json.
2. The OpenClaw gateway is restarted, activating allowAgents: ["*"].
3. An untrusted, compromised, or unintended agent identity is present or is added later.
4. The primary agent receives an instr ...[truncated 942 chars]

Remediation

View remediation

Remediation Suggestions

• Replace wildcard authorization with an explicit allowlist:

  json

  {
    "agents": {
      "defaults": {
        "subagents": {
          "allowAgents": ["member-a", "member-b"]
        }
      }
    }
  }
  

• Make explicit allowlisting the primary documented configuration rather than an optional alternative.
• Reject unknown agent identifiers and require administrative confirmation before adding a new agent to the allowlist.
• Review each authorized agent's workspace, persona instructions, tools, and operating-system permissions before enabling it.
• Grant each subagent only the tools and filesystem access needed for its assigned role.
• Require confirmation before sending sensitive context to a subagent.
• Audit configuration changes after gateway restarts and periodically remove unused agent identities.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is written as an instruction set in Chinese and presents the workflow and usage entirely in that language, including the example user invocation. There is no indication that other languages are supported or that the user can choose their preferred language, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

bash

# 创建成员 workspace
mkdir -p ~/.qclaw/workspace-main/{analyst,writer,reviewer}

# 写入成员 SOUL.md
echo "你是分析师，负责数据分析..." > ~/.qclaw/workspace-main/analyst/SOUL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

bash

# 创建成员 workspace
mkdir -p ~/.qclaw/workspace-main/{analyst,writer,reviewer}

# 写入成员 SOUL.md
echo "你是分析师,负责数据分析..." > ~/.qclaw/workspace-main/analyst/SOUL.md

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill metadata description is written as a prescriptive Chinese workflow description, and the document provides all operational instructions exclusively in Chinese without indicating this is optional or region-specific. This creates a language/locale constraint with no user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation text '派任务给团队成员、协调子代理、管理多会话通信' describes common coordination activities in broad terms without specifying exact trigger phrases, scope limits, or exclusion conditions. In a markdown skill description, this can overlap with ordinary requests about teamwork or coordination and create ambiguity about when the skill should activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This duplicate finding points to the same persistent workspace creation behavior. The danger is not the directory creation alone, but that the skill normalizes long-lived storage of agent personas and outputs without warning about residual data exposure, cross-session leakage, or cleanup requirements.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

为每个成员创建独立目录：

bash

mkdir -p ~/.qclaw/workspace-main/{member-a,member-b,member-c}

Step 2：写入成员 SOUL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This duplicate finding points to the same persistent workspace creation behavior. The danger is not the directory creation alone, but that the skill normalizes long-lived storage of agent personas and outputs without warning about residual data exposure, cross-session leakage, or cleanup requirements.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

为每个成员创建独立目录:

bash

mkdir -p ~/.qclaw/workspace-main/{member-a,member-b,member-c}

Step 2:写入成员 SOUL.md

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends configuring allowAgents: ["*"], which broadly enables spawning any agent ID rather than only the intended team members. In an adversarial or multi-agent environment, this expands the attack surface and can permit unintended subagent invocation, privilege spread, or misuse of trusted orchestration flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to modify persistent configuration and restart a gateway service without a prominent user-impact or security warning. Those are privileged, state-changing operations that can alter future agent behavior, cause service disruption, and silently persist expanded capabilities beyond the immediate task.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The section at L206-L210 states '主代理不执行' and explicitly says the main agent should not write code, modify files, or execute scripts. Elsewhere, the same document instructs creating directories, writing SOUL.md files, modifying ~/.qclaw/openclaw.json, restarting the gateway, and even prewriting Python scripts for subagents, which directly contradicts that stated rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese throughout for headings, workflow descriptions, and code comments, but does not indicate that the skill is Chinese-only or provide any user opt-in for language/locale. Under the policy rule for natural-language violations, forcing a specific language without user choice is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes substantive natural-language content in Chinese, but nothing in the file indicates that the language is optional, user-selected, or justified by a region-specific scope. Under the language/locale policy check, forcing a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.