Sub Agent Factory

Rapidly spawn and configure specialized sub-agents. Includes templates for Research, Coding, and Analysis agents. Automates workspace setup and instruction d...

This skill is small and appears coherent, but take basic precautions: run it in a dedicated workspace to avoid cluttering other projects, inspect any generated agents' SKILL.md before enabling them, and avoid placing sensitive credentials into the agents' inbox/outbox. Autonomous agent invocation is allowed by platform default — be careful what tasks you give spawned sub-agents (they may read/write files within the agents/<name> folders and could be instructed to perform network actions if their SKILL.md or runtime instructions are expanded later).

Type: OpenClaw Skill Name: sub-agent-factory Version: 1.1.0 The `scripts/create_agent.sh` file is vulnerable to shell injection and prompt injection due to unsanitized use of user-provided `NAME` and `ROLE` arguments. An attacker could craft malicious inputs for these arguments to execute arbitrary commands on the host system when the script is run, or to inject malicious instructions into the newly created sub-agent's `SKILL.md` file. While the script's stated purpose is benign, this critical vulnerability allows for unauthorized command execution and agent manipulation, classifying it as suspicious rather than benign or malicious.