Parallel Agents

Spawns real AI-powered OpenClaw sub-sessions to run multiple specialized agents concurrently for content, dev, QA, docs, and autonomous workflows.

This skill implements a legitimate-sounding parallel-agent orchestrator — the code and docs align with that purpose. However, before installing or running it, consider the following: 1) Spawned agents are 'real' sub-sessions that the skill says will have 'all the same tools as the host' — if your host session has access to secrets, file I/O, or networked services, child agents may be able to read and transmit that data. 2) The docs and examples explicitly show reading local files (e.g., open('app.py').read()) and passing their contents to spawned agents — avoid doing that in sessions with sensitive data. 3) A prompt-injection pattern was detected in SKILL.md; review all system prompts and templates in ai_orchestrator.py and helpers.py to ensure they don't instruct child agents to exfiltrate, override safeguards, or run privileged actions. 4) Mitigations: run this skill only in agent sessions that do not hold credentials or sensitive files; sandbox the host so spawned agents cannot access secrets; remove or sanitize example code that reads local files; require admin approval before allowing sessions_spawn in environments with privileged access; audit and possibly restrict which tools child sessions can use. If the vendor can provide documentation guaranteeing spawned sessions do not inherit secret-bearing credentials or can be configured to run with minimal privileges, that would lower the risk and increase my confidence.

Type: OpenClaw Skill Name: parallel-agents Version: 3.2.0 The skill is classified as suspicious due to its explicit use of OpenClaw's `sessions_spawn` tool, which grants spawned AI sub-sessions 'all the same tools as the host'. While this is the stated purpose of the skill, it represents a high-risk capability. Furthermore, the `ai_orchestrator.py` and `helpers.py` modules construct sub-agent prompts by directly embedding user-provided `task_description` and `input_data`, creating a potential prompt injection surface for sub-agents if a malicious user crafts these inputs. There is no clear evidence of intentional malicious behavior by the skill developer, but the inherent power and potential for misuse warrant a 'suspicious' classification.