Task Orchestra

Coordinate multiple agents and tasks for complex workflows. Orchestrate subagents, manage dependencies, handle parallel execution, and ensure successful comp...

This skill's described orchestration features are plausible, but several inconsistencies suggest caution: - Ask the publisher (or repository) why BRAVE_API_KEY is required and what it's used for; do not provide sensitive tokens until that is explained. - Confirm why an npm 'async' package and an 'async' binary are installed — that package is normally a JS library, not a CLI. If you must install it, review the exact package and its maintainer and audit the package contents in a sandbox first. - Because the skill can spawn and steer subagents, run it in a restricted/sandboxed environment and limit its privileges on first use. - Prefer skills with a verifiable source/homepage and code you can inspect; this skill has no source URL or code files. If you cannot get a clear explanation for the BRAVE_API_KEY and the odd install spec, treat this skill as untrusted and avoid installing it or set it up in an isolated test environment only.

Type: OpenClaw Skill Name: task-orchestra Version: 1.0.0 The skill 'task-orchestra' is classified as suspicious due to its powerful capabilities that, while aligned with its stated purpose of agent orchestration, present significant security risks. It requires access to `curl` and `jq` (enabling network and shell command execution) and the `BRAVE_API_KEY` environment variable (access to a secret). Crucially, the skill instructs the agent on how to spawn, steer, and kill subagents (`sessions_spawn`, `sessions_send`, `subagents kill`, `subagents steer`), which are powerful primitives that could be leveraged for unauthorized actions or data exfiltration if the agent receives malicious prompts. While there are no explicit instructions for malicious behavior within the `SKILL.md` itself, the combination of broad permissions and powerful execution capabilities makes it a high-risk component.