agent-creation
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a domain-specific command-line tool,
openclaw, to perform administrative tasks such as adding agents (openclaw agents add) and setting their identities (openclaw agents set-identity). - [DATA_EXFILTRATION]: No exfiltration risks were identified. File operations are confined to a dedicated application directory (
~/.openclaw/workspace-<agent-name>) for storing agent-specific configurations and memory logs. - [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection by interpolating user-provided names and identity descriptions into shell commands and configuration files. However, it includes instructional constraints, such as requiring lowercase English and hyphens for agent names, which mitigates simple command injection attempts.
Audit Metadata