OpenClaw SubAgents Creator

This skill should be used when the user wants to configure, spawn, or manage OpenClaw (formerly Clawdbot) subagents. It covers the full setup workflow: editi...

This skill appears to implement exactly what it claims, but it instructs you to create persistent cron/pm2 jobs, run shell/browser actions, and store/use session keys and Convex CLI credentials. Before installing/using it: (1) Confirm where and how session keys and Convex/gateway credentials will be stored — avoid plaintext in shared files; (2) Limit subagent tool permissions and enable per-agent sandboxing (use tools.deny / allowAgents / sandbox settings) so subagents cannot exec arbitrary host commands or read unrelated files; (3) Treat AGENTS.md and workspace directories as sensitive — rotate and restrict access to session keys; (4) Run the notification daemon and crons in a controlled environment (container or restricted user account) if possible; (5) If you need stronger assurance, ask the skill author for explicit documentation of required environment variables/credentials and an audited example deploy manifest showing least-privilege sandboxing. Providing those details would move this assessment toward 'benign'.

Type: OpenClaw Skill Name: openclaw-subagents Version: 1.0.0 The skill bundle provides a legitimate framework for configuring and orchestrating OpenClaw subagents and multi-agent squads. It includes comprehensive documentation for agent identity files (SOUL.md, AGENTS.md), configuration schemas for openclaw.json, and instructions for managing tasks via a shared 'Mission Control' database using the Convex CLI. While the skill utilizes powerful features like cron jobs for agent heartbeats and programmatic session spawning (sessions_spawn), these behaviors are strictly aligned with the stated purpose of multi-agent orchestration and lack any indicators of malicious intent, data exfiltration, or unauthorized access.