← 返回 Skills 市场

AOI Squad Orchestrator (Lite)

Name: AOI Squad Orchestrator (Lite)
Author: edmonddantesj

作者 edmonddantesj · GitHub ↗ · v0.1.1

cross-platform ⚠ suspicious

720

总下载

当前安装

版本数

在 OpenClaw 中安装

/install aoi-squad-orchestrator-lite

功能描述

Orchestrate teams with three role presets, stable pseudonyms, renaming options, and generate a fixed JSON report for each task.

使用说明 (SKILL.md)

AOI Squad Orchestrator (Lite)

S-DNA: AOI-2026-0215-SDNA-SQUAD01

What this is

A public-safe productized orchestration skill that:

provides 3 selectable presets (each 3 roles)
assigns each role a stable pseudonym (no AOI internal nicknames)
lets users rename team members
emits a single fixed JSON report schema for easy parsing & testing

What this is NOT

No external posting, no web crawling, no form submit.
No wallets/trading/purchases.
No automatic privilege escalation.

Presets

planner-builder-reviewer
researcher-writer-editor
builder-security-operator

Commands

List presets

aoi-squad preset list

Show current team names (stable per preset)

aoi-squad team show --preset planner-builder-reviewer

Rename a team member

aoi-squad team rename --preset planner-builder-reviewer --role reviewer --name "Sentinel Kestrel"

Run (MVP: structured report)

aoi-squad run --preset planner-builder-reviewer --task "Draft a launch checklist"

Data

Team name mapping is stored locally:
- ~/.openclaw/aoi/squad_names.json

Support

Issues / bugs / requests: https://github.com/edmonddantesj/aoi-skills/issues
Please include the skill slug: aoi-squad-orchestrator-lite

License

MIT

安全使用建议

This skill appears to do exactly what it says: create and persist local pseudonym mappings and emit a fixed JSON report. Before installing, consider: (1) it will create and write ~/.openclaw/aoi/squad_names.json in your home directory; (2) the code runs locally (skill.js) — review the file if you prefer to verify behavior yourself; (3) the SKILL.md links to a GitHub repo for issues, but the source author is not strongly identified in metadata — if provenance matters, verify the upstream repo/author; (4) the skill requests no secrets or network access, so risk is low. If you need stricter isolation, run it in an environment/user account where creating that ~/.openclaw path is acceptable.

功能分析

Type: OpenClaw Skill Name: aoi-squad-orchestrator-lite Version: 0.1.1 The skill.js script is vulnerable to prompt injection against the OpenClaw AI agent. User-controlled inputs like `--task` and `--name` are embedded into the `report_markdown` field of the output JSON. The `mdEscape` function only escapes `<` and `>`, leaving other Markdown syntax (e.g., `#`, `*`, `[`, `]`, ` `) unescaped. This allows an attacker to inject arbitrary Markdown into the report, which an AI agent consuming this output could interpret as new instructions, potentially leading to unauthorized actions. While the skill itself does not exhibit malicious intent (e.g., no data exfiltration, no persistence mechanisms), this vulnerability creates a significant attack surface for an AI agent.

能力评估

✓ Purpose & Capability

Name, description, SKILL.md, and skill.js align: presets, stable pseudonyms, renaming, and producing a fixed JSON report are implemented and no unrelated capabilities (cloud, wallets, posting) are requested.

✓ Instruction Scope

Runtime instructions and code stay within the declared scope: they read/write a single local config (~/.openclaw/aoi/squad_names.json), validate rename input, and generate a local JSON/markdown report. The instructions do not request additional system files, env vars, or external endpoints.

✓ Install Mechanism

No install spec or external downloads are used. The skill is instruction-only with an included Node CLI script (skill.js). This means the code will run locally but nothing is fetched from remote URLs during install.

✓ Credentials

The skill requires no environment variables, no credentials, and no unrelated config paths. All data access is limited to one file under the user's home directory as described in SKILL.md.

✓ Persistence & Privilege

always is false, the skill does not request permanent platform-level privileges, and it only writes/reads its own config path (~/.openclaw/aoi/squad_names.json). It does not modify other skills or system-wide agent settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install aoi-squad-orchestrator-lite
安装完成后，直接呼叫该 Skill 的名称或使用 /aoi-squad-orchestrator-lite 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.1

MVP: presets + stable pseudonym team names + rename + fixed JSON report schema (public-safe).

元数据

Slug aoi-squad-orchestrator-lite

版本 0.1.1

许可证 —

累计安装 4

当前安装数 3

历史版本数 1

常见问题