Multi Agent Coordinator Zhuyu28

Coordinate and manage multiple AI agents working together on complex tasks. Provides orchestration, communication patterns, and workflow management for multi...

This skill appears to do what it says: coordinate agents and persist session state locally. Before installing, consider: (1) the included Python script writes a session JSON file to the current working directory (default: coordination_session.json) — run it where that is acceptable or change the path; (2) review the provided source yourself if you need to ensure no remote calls are added later (currently there are none); (3) there are no requested credentials or network endpoints, so it does not appear to exfiltrate data, but if you intend to run it in an environment with sensitive files, run it in a sandbox or dedicated directory. If you need the coordinator to interact with external services later, expect new environment variables or network calls to require an updated review.

Type: OpenClaw Skill Name: multi-agent-coordinator-zhuyu28 Version: 1.0.0 The skill bundle contains a vulnerability in `scripts/coordinate_agents.py` related to insecure file handling. The script allows users to specify a `session_file` path which is used directly in `open()` calls for both reading and writing without any path sanitization or validation. This could be exploited to perform arbitrary file read or write operations (e.g., overwriting system configurations or sensitive files with JSON data) if the agent is manipulated into using a malicious path. While the logic is consistent with the stated goal of multi-agent coordination, the lack of input sanitization is a significant security flaw.