Task Router Skill

Distributed task queue for OpenClaw multi-agent systems that routes tasks by capability, tracks lifecycle, coordinates async handoffs, rebalances load, and m...

This skill appears to implement a local task router and is internally consistent, but it leaves out important operational and security details. Before installing or using it in production, verify: (1) how agents authenticate and how registrations/heartbeats are authorized (prevent rogue agents from registering or stealing tasks); (2) the network transport used for agent communication and whether it uses TLS; (3) how notifications to external services (Discord, etc.) are configured and where secrets are stored; (4) who can run the 'task' CLI and whether file permissions on ~/.openclaw/task-router are restricted; (5) whether logs or task payloads may contain sensitive data and how they're protected. If the publisher cannot document agent auth, token handling, and runtime hosting, run the router in a sandboxed environment only and audit agent registrations and filesystem permissions.

Type: OpenClaw Skill Name: task-router-skill Version: 1.0.0 The skill is classified as suspicious due to several potential vulnerabilities, primarily related to prompt injection vectors and broad file system access, rather than clear malicious intent. The `HEARTBEAT.md` script uses `sessions_send` to notify other agents about task completion, including user-controlled `task.title` and `task.result` (a file path). This creates a potential prompt injection vector if a malicious actor crafts these inputs. Additionally, CLI commands like `task export` allow writing task data to arbitrary user-specified file paths, and `task result` allows viewing arbitrary result files, which could be abused for unauthorized file access or writes if input paths are not properly sanitized. While these capabilities are plausible for a task router, the lack of explicit input sanitization for user-controlled strings and paths presents significant security risks.