SAAS Orchestrator

Orchestrate SAAS factory operations - spawn subagents, track projects, manage revenue targets, and coordinate development workflows. Use when building a SAAS...

This skill appears to do what it says: orchestrate SAAS subagents and track project/revenue status. Before installing or running it, consider the following: (1) review the included Python scripts yourself — they only write local task/status text files and print reports, but verify there are no network calls you don't expect; (2) do not provide API keys (Stripe, Google, etc.) unless you intentionally connect those services — the skill's docs mention them but they are not required by the skill itself; (3) run the scripts in a sandbox or isolated environment if you plan to let an agent execute them autonomously, and limit the agent's ability to access sensitive files or credentials; (4) note the skill has no homepage or source attribution — if provenance matters to you, request or inspect the upstream source before use. If you want a stricter posture, disable autonomous invocation or run the skill in read-only mode first to observe behavior.

Type: OpenClaw Skill Name: saas-orchestrator Version: 1.0.0 The skill bundle is classified as suspicious due to significant prompt injection vulnerabilities identified in `scripts/spawn-saas-builder.py` and `scripts/spawn-saas-researcher.py`. Both scripts directly embed unsanitized command-line arguments into the generated 'task' strings, which are intended as prompts for subagents. This allows an attacker to inject arbitrary instructions into the subagent's prompt, potentially leading to unauthorized actions by the subagent. While the scripts' primary purpose is benign (generating tasks and reports), this lack of input sanitization represents a critical vulnerability.