Security audit

multi-agent-deploy

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it claims: create a new local OpenClaw assistant agent and update local OpenClaw configuration.

Install this only if you want a skill that can add local OpenClaw assistant agents. Before running it, review or back up ~/.openclaw/openclaw.json and expect new workspace and agent directories under /home/admin/.openclaw; use an explicit confirmation workflow if accidental agent creation would be disruptive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The functionality section emphasizes automation and one-click deployment but does not clearly warn that running the skill creates directories, copies files, and edits openclaw.json. Users may invoke it assuming it is informational or low risk, increasing the chance of unsafe local changes in environments where skill execution is triggered from natural language.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The README advertises very broad natural-language triggers such as '新增一个 agent' and '加一个日常助手' without any confirmation step or narrowing constraints. In an agentic environment, this can cause unintended invocation from casual user phrasing, leading to automatic creation of agents and configuration changes on the local system.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs execution of a deployment script and documents writes to agent directories and `~/.openclaw/openclaw.json`, but it declares no `permissions` or `allowed-tools` scope. That mismatch weakens least-privilege controls and makes unintended or overly broad filesystem/configuration modification easier if the skill is invoked.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The top-level description and trigger examples are broad enough to match ordinary conversational requests about adding an assistant, increasing the chance the skill auto-invokes in contexts where the user did not intend system deployment. Because this skill performs persistent filesystem and configuration changes, ambiguous triggering materially raises the risk of unintended modification.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation section lists several natural-language phrases but provides no hard boundary between discussion and execution, nor any requirement for environment or authorization checks. In a skill that creates directories and edits live configuration, this ambiguity can cause accidental or unauthorized deployment actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This section describes creating new workspaces, creating agent directories, modifying `~/.openclaw/openclaw.json`, and restarting the gateway, but it does not prominently warn that these are persistent system changes. Users or orchestrators may treat the skill as routine assistance rather than an administrative action, increasing the chance of disruptive or unauthorized changes to the agent environment.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The top-level docstring states the skill behavior in Chinese and specifies the agent as a '日常助手', indicating a Chinese-language/localized assistant setup without any visible option for user language choice. This is a natural-language locale constraint and no opt-in or justification is documented in the file.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The README presents the skill description and example invocation phrases exclusively in Chinese, including instructing users to '直接说' specific Chinese phrases to activate it. This imposes a language expectation without offering user choice, opt-in, or justification for a locale-specific audience.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The manifest description and trigger examples are presented in Chinese, which implicitly constrains usage language but does not state that the skill is Chinese-only or offer an alternative language option. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: The package description is written entirely in Chinese, which signals a fixed language choice in the skill's natural-language metadata. There is no indication that users can choose another language or that the Chinese-only description is required for a region-specific purpose.

Static analysis

No suspicious patterns detected.