中文 EN

Scan Report

Scan New Files

This report was generated in Chinese. Some content may be in Chinese.
⚠ Low Risk — Risk Score 18/100
Last scan:5 hr ago Rescan
18 /100
multi-agent-builder
Build a reusable multi-agent team in OpenClaw from a user goal
团队构建工具，文档与代码存在轻微权限声明差异（filesystem:READ vs 实际WRITE），但操作范围限于 OpenClaw 配置目录，无恶意行为。
Skill Namemulti-agent-builder
Duration33.8s
Enginepi
ClawHub Multi Agent Builder v1.0.0 by gzgogo
📥 250 📦 2 ⭐ 2
ClawHub Verdict Suspicious dangerous_execllm_suspiciousvt_suspicious
✓
Safe to install
建议在 SKILL.md 中补充 filesystem:WRITE 声明以保持文档一致性。

Findings 2 items

Severity Finding Location
Low
文件写入权限未在文档中声明 Doc Mismatch
SKILL.md 未声明 filesystem 权限，但 materialize_team.mjs 实际执行写操作创建团队配置目录和文件
fs.writeFileSync(path.join(agent.workspace,'SOUL.md'),soul);
→ 在 SKILL.md 的 Resources 或声明段落补充 filesystem:WRITE 权限说明
 scripts/materialize_team.mjs:67
Info
硬编码平台配置路径 Priv Escalation
使用硬编码路径 /root/.openclaw/ 但属于 OpenClaw 平台合法操作范围
const cfgPath = args.config || '/root/.openclaw/openclaw.json';
→ 非风险，仅为平台架构已知限制
 scripts/materialize_team.mjs:27
ResourceDeclaredInferredStatusEvidence
Filesystem NONE READ,WRITE ✓ Aligned scripts/materialize_team.mjs:67 fs.writeFileSync 写入 SOUL.md/AGENTS.md/IDENTITY.m…
Shell NONE NONE — create_team.mjs 仅使用 spawnSync 调用本地脚本，无裸 shell 执行

File Tree

27 files · 55.4 KB · 1503 lines
Markdown 22f · 1269L JavaScript 4f · 212L JSON 1f · 22L
├─ ▾ 📁 references
│ ├─ 📝 capability-matrix.md Markdown 68L · 1.8 KB
│ ├─ 📝 channel-binding-blueprints.md Markdown 54L · 1.9 KB
│ ├─ 📝 collaboration-protocol.md Markdown 50L · 1.6 KB
│ ├─ 📝 config-materialization-checklist.md Markdown 32L · 1.2 KB
│ ├─ 📝 create-playbook.md Markdown 106L · 3.6 KB
│ ├─ 📝 dialog-flow.md Markdown 60L · 2.5 KB
│ ├─ 📝 examples.md Markdown 65L · 1.6 KB
│ ├─ 📝 failure-modes.md Markdown 87L · 2.5 KB
│ ├─ 📝 final-deliverable-sample.md Markdown 65L · 2.0 KB
│ ├─ 📝 language-templates.md Markdown 21L · 1.4 KB
│ ├─ 📝 materialization-checklist.md Markdown 33L · 1.4 KB
│ ├─ 📝 output-templates.md Markdown 50L · 2.1 KB
│ ├─ 📝 permission-profiles.md Markdown 45L · 1.3 KB
│ ├─ 📝 provisioning-playbook.md Markdown 62L · 2.4 KB
│ ├─ 📝 role-catalog.md Markdown 51L · 923 B
│ ├─ 📋 role-display-mapping.json JSON 22L · 687 B
│ ├─ 📝 role-soul-blueprints.md Markdown 37L · 1.5 KB
│ ├─ 📝 security-report-schema.md Markdown 57L · 1.2 KB
│ ├─ 📝 snippet-templates.md Markdown 58L · 1.6 KB
│ ├─ 📝 splitting-principles.md Markdown 77L · 2.7 KB
│ ├─ 📝 team-leader-agents-template.md Markdown 19L · 646 B
│ └─ 📝 team-leader-template.md Markdown 30L · 1.4 KB
├─ ▾ 📁 scripts
│ ├─ 📜 create_team.mjs JavaScript 39L · 1.4 KB
│ ├─ 📜 emit_report.mjs JavaScript 31L · 1.3 KB
│ ├─ 📜 materialize_team.mjs JavaScript 102L · 5.2 KB
│ └─ 📜 validate_team.mjs JavaScript 40L · 2.1 KB
└─ 📝 SKILL.md Markdown 142L · 7.6 KB

Security Positives

✓ 有完整的备份机制（.bak.materialize）防止配置损坏
✓ validate 阶段提供配置完整性检查
✓ 文档中有明确的安全确认策略（Safe execution guardrails）
✓ 无外部网络请求或凭证外传
✓ 脚本链清晰，职责分离明确
✓ 支持路径参数化（--config）提高灵活性