TeamWork

Dynamically creates and manages AI agent teams for complex tasks. Invoke when user requests multi-agent collaboration, complex project execution, or when tasks require specialized roles and coordinated workflow.

This skill implements team orchestration and will create and modify files under .trae/config and .trae/data (providers.json, team-roles.json, model_scores.json). It will ask you for API keys or the names of environment variables for any providers you configure and will persist that provider info in .trae/config/providers.json. Before installing or using it: - Understand it will store provider credentials/config locally (likely plaintext). If you don’t want keys stored on disk, avoid entering them or use minimally privileged keys. - Prefer supplying environment variable names rather than pasting secrets into interactive prompts, but note the code appears not to resolve process.env itself — verify how your host resolves those placeholders. - Review and restrict file permissions on .trae/config (e.g., chmod 600) and keep backups out of shared repos. - If you need provider integrations (OpenAI, Anthropic, Google, etc.), confirm how provider calls will be performed (the skill’s code does not include HTTP calls) and whether the host agent will use stored keys. - Validate the author/source before providing sensitive credentials and consider testing in an isolated environment first. If you want, I can point out the exact lines where credentials are written to disk and suggest code changes to avoid plaintext storage (e.g., use OS credential stores or encrypt configs).

Type: OpenClaw Skill Name: teamwork Version: 1.0.0 The 'teamwork' skill is classified as suspicious due to its inherent high-risk capabilities, which include managing AI provider API keys, performing file system operations for configuration, and orchestrating complex multi-agent tasks. While these actions are central to the skill's stated purpose and there is no direct evidence of malicious intent (e.g., data exfiltration to unauthorized endpoints, malicious command execution, or obfuscation), the extensive control over sensitive credentials and agent behavior presents a significant attack surface. The `SKILL.md` instructs the OpenClaw agent to handle API keys (stored as environment variable references in `providers.json`) and to display configuration, which could lead to information leakage if the agent's runtime resolves these environment variables before displaying them to a potentially untrusted user. The skill's complexity and powerful functionality, even when aligned with its stated purpose, elevate its risk profile beyond benign.