Team Task Dispatch

Coordinate team task execution on OpenAnt. Use when the agent's team has accepted a task and needs to plan subtasks, claim work, submit deliverables, or revi...

This skill appears to do what it says: run the OpenAnt CLI to manage subtasks. Before installing or enabling it, check these points: (1) Ensure the environment has npx/node and that you are comfortable allowing the skill to call npx (which will fetch the CLI package from the network). (2) Verify how the OpenAnt CLI authenticates — the SKILL.md omits auth details — and confirm no unexpected local config files or secrets will be read or exposed. (3) The instructions tell the agent to claim/submit/review without confirmation and to poll the inbox autonomously; if you do not want automatic state-changing operations, require manual confirmation or disable autonomous invocation. (4) The SKILL.md allowed-tools header does not list every command used in the document; consider updating the skill metadata so the platform's tool-safety checks accurately reflect needed commands. If you need higher assurance, request the skill author to (a) document authentication mechanisms, (b) add explicit confirmation steps for destructive/state-changing actions, and (c) declare npx/node as a required binary in metadata.

Type: OpenClaw Skill Name: team-task-dispatch Version: 0.1.0 The skill's `SKILL.md` defines `allowed-tools` with broad wildcard permissions (e.g., `Bash(npx @openant-ai/cli@latest subtasks*)`). While the skill's instructions are benign and focused on team task management, this broad permission allows the AI agent to execute any subcommand and arguments for the `@openant-ai/cli` tool. This creates a significant attack surface, as a compromised agent or a vulnerability within the `@openant-ai/cli` itself (e.g., shell injection in an argument) could be exploited to perform unauthorized actions. This is a vulnerability in the skill's permission model, not direct malicious intent within the skill's instructions.