项目制多智能体开发协议

激活项目制多智能体开发协议。用于处理复杂的代码开发、系统搭建等需求。该工具将在后台自动拆解任务、调度程序员和测试员、更新 dev_project.md 并处理错误重试。

总体上此技能在设计上自洽且影响面有限，但在安装/运行前请注意：1) 备份 ~/.openclaw/workspace/dev_Project.md 和相关文件——脚本会就地修改这些文件且其替换逻辑依赖特定模板；2) 检查并创建 SKILL.md/脚本中引用的路径（~/.openclaw/venv、memory_viewer.py、system_protocol_project_mode.md 等），否则部分步骤会失败；3) 当前代码用占位字符串代替真正的 LLM 调用——如果未来版本引入网络/外部 API 调用或凭证需求，请重新评估；4) 在受控环境（非生产关键数据）先运行验证其行为与文件修改是否符合期望。

Type: OpenClaw Skill Name: project-mode Version: 1.0.1 The skill is designed for complex code development and system setup, inherently requiring high-risk capabilities. The `SKILL.md` explicitly instructs the AI agent to execute shell commands (e.g., `python3 ~/.openclaw/workspace/memory_viewer.py`, `grep`), which, while aligned with the stated purpose, represents a powerful and potentially exploitable capability. The `project_mode_skill.py` script performs extensive file system operations (reading/writing `dev_Project.md`, `system_protocol_project_mode.md`) and uses `re.sub` to update these files. If user-controlled input (e.g., `user_requirement`, `error_msg`) were not properly sanitized before being used in these updates, it could lead to content injection into `dev_Project.md`, potentially influencing future agent behavior. The design also indicates future LLM integration, which would introduce significant prompt injection risks. No direct malicious intent like data exfiltration or backdoors is observed, but the combination of powerful capabilities and potential input handling vulnerabilities makes it suspicious.