Skills
Navigate
skills/theangrypit/theangryskills/openclaw-team-handoff/Gen Agent Trust Hub

openclaw-team-handoff

Warn

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script in scripts/team-handoff.sh executes the OpenClaw CLI for gateway interaction and the cloudflared utility for authentication. It also uses ssh to run commands on a remote host.
  • [PRIVILEGE_ESCALATION]: The SSH fallback mode uses sudo -n -u $REMOTE_USER to execute the OpenClaw CLI as a different user on the remote gateway host.
  • [DYNAMIC_EXECUTION]: The ensure_profile function in scripts/team-handoff.sh dynamically generates an openclaw.json configuration file that specifies an exec provider to run the cloudflared binary for fetching tokens.
  • [DATA_EXFILTRATION]: The create command reads the content of a local file specified by the user and transmits it to a remote Gateway URL via the CLI's network capabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided file content in the create command, creating an attack surface for indirect prompt injection targeting the remote agent. 1. Ingestion point: The --message-file parameter in scripts/team-handoff.sh. 2. Boundary markers: None; the content is interpolated directly into the JSON payload. 3. Capability inventory: Local shell execution, network operations, and remote command execution via SSH and sudo. 4. Sanitization: The content is escaped for JSON using json.dumps.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 30, 2026, 10:59 AM