agent-creator

Full workflow for creating an OpenClaw Agent. Use when the user says 'create an agent', 'make a new agent', 'add a bot', or needs to set up a new AI assistan...

This skill appears to do exactly what it claims (scaffold an OpenClaw agent) and contains a helper script that will modify ~/.openclaw/openclaw.json, copy main agent config files, create workspace folders, and restart the OpenClaw gateway. Before installing or running it: (1) review the helper script (included) yourself or run it in a safe/test environment; (2) back up ~/.openclaw/openclaw.json (the script already does a backup, but keep your own copy if you're cautious); (3) inspect models.json and auth-profiles.json in your main agent — auth-profiles.json can contain secrets and will be copied into the new agent directory; (4) be prepared to manually restart the gateway if the automatic restart fails; and (5) only run this if you trust the skill source or prefer to execute the steps manually to maintain control.

Type: OpenClaw Skill Name: sub-agent-creator Version: 1.0.1 The skill bundle automates the creation of new OpenClaw agents, which involves high-risk operations such as modifying the primary 'openclaw.json' configuration and copying sensitive credential files ('auth-profiles.json', 'models.json') that likely contain API keys. The accompanying Python script 'scripts/agent_creator.py' is vulnerable to path traversal because it fails to validate the 'agent_id' input before using it to construct file system paths for directory creation and configuration entries. While these capabilities are plausibly needed for the stated purpose of agent scaffolding, the combination of credential handling, system-level configuration changes, and unvalidated input represents a significant security risk.