Workhorse Duo

Run a practical two-worker orchestration workflow with Xiaoma (execution) and Xiaoniu (QA). Use when the user wants 小马执行 / 小牛验收, when a medium/large task sho...

This skill implements a legitimate execute->QA local workflow, but it assumes and performs privileged local actions that are not declared in the top-level metadata. Before running any bootstrap helper or using AutoFixConfig: 1) Verify you have the openclaw CLI installed and you understand the commands; 2) Inspect the PowerShell helper and only run it manually if you trust the source; 3) Prefer running the bootstrap with AutoFixConfig disabled, check the current ~/.openclaw/openclaw.json yourself, and make any changes manually so you control exactly what fields change; 4) Be cautious about accepting agentToAgent.allow = ["*"] and sessions.visibility = "all" — these widen cross-agent visibility and can increase data-sharing/exposure; tighten policies after validation; 5) Keep backups of openclaw.json (the helper makes a .bak) and know how to restore/restart the gateway if needed. The package should have declared required binaries/config paths — absence of that declaration is an omission worth questioning with the publisher.

Type: OpenClaw Skill Name: workhorse-duo Version: 2.1.2 The skill bundle implements a multi-agent orchestration workflow but includes a PowerShell bootstrap script (in published-bootstrap-helper.md) that modifies the local OpenClaw configuration. Specifically, it enables broad cross-agent communication permissions (agentToAgent.allow = ['*']) and performs a service restart (openclaw gateway restart). While these actions are documented as setup requirements and accompanied by rollback instructions in risk-and-rollback.md, the automated modification of security-sensitive configurations and service management constitutes a high-risk capability.