Agent Council

Shell command execution function detected

system (

Sub-agent spawning instructions detected — may create agents with attacker-controlled prompts

Spawn Sub-Agent

Sub-agent spawning instructions detected — may create agents with attacker-controlled prompts

spawn a sub-agent

The skill allows defining 'cron execution logic' within HEARTBEAT.md files for agents. This provides a direct mechanism for an attacker to schedule and execute arbitrary commands on the host system with persistence.

HEARTBEAT.md (cron execution logic)

The `sessions_spawn` function takes a user-controlled `task` string, which is then executed by a sub-agent. This is a direct prompt injection vector, allowing an attacker to dictate the sub-agent's actions and potentially execute malicious tasks.

sessions_spawn({
  agentId: "watson",
  task: "Research competitive landscape for X and write a report",

The `create-agent.sh` and `rename-channel.py` scripts accept user-controlled `--workspace` paths. This allows the skill to create, read, and modify files in arbitrary directories, which can be abused for data exfiltration, injecting malicious code into agent configuration files, or other forms of compromise.

scripts/create-agent.sh \
  --workspace "$HOME/agents/watson"

The skill requires and manages Discord bot tokens for channel management. Given the broad file system access and command execution capabilities identified, there is an inherent risk of these sensitive credentials being exposed or exfiltrated if the skill or its underlying scripts are compromised.

Discord bot token (for channel management)

The ability to spawn long-running sub-agents with `runTimeoutSeconds` and define persistent cron jobs in `HEARTBEAT.md` creates a vector for resource exhaustion (e.g., CPU, memory, network) if an attacker can control agent tasks or cron logic.

runTimeoutSeconds: 3600,  // 1 hour max

User-supplied parameters (--name, --specialty, --workspace, --discord-channel) are passed directly to shell scripts without visible sanitization. If workspace paths or agent names contain shell metacharacters, this could lead to command injection in create-agent.sh and rename-channel.py.

scripts/create-agent.sh \
  --name "Agent Name" \
  --id "agent-id" \
  --emoji "🤖" \
  --specialty "What this agent does" \
  --model "provider/model-name" \
  --workspace "/path/to/workspace" \
  --discord-channel "1234567890"

The skill instructs direct patching of gateway configuration using --raw JSON flags. If the JSON content is derived from user input or external data, this could allow arbitrary gateway configuration modification including allowlist changes and system prompt injection.

openclaw gateway config.patch --raw '{
  "skills": {
    "entries": {
      "agent-council": {"enabled": true}
    }
  }
}'

The skill directly modifies the central OpenClaw gateway configuration using `openclaw gateway config.patch --raw '{...}'`. If the raw JSON input is attacker-controlled, it can lead to systemic compromise, such as altering agent models, modifying access controls, or creating malicious bindings.

openclaw gateway config.patch --raw '{"channels": {...}}'

The skill explicitly documents and encourages spawning sub-agents with arbitrary task strings, including agent-to-agent communication. If any input reaching these task strings is user- or externally-controlled, this enables prompt injection into spawned agent sessions with potentially broad tool access.

sessions_spawn({
  agentId: "watson",
  task: "Research competitive landscape for X and write a report",
  model: "skillboss/pilot",
  runTimeoutSeconds: 3600,
  cleanup: "delete"
})

The skill configures sub-agents with run timeouts up to 7200 seconds (2 hours) and cleanup modes of 'keep', enabling long-running autonomous sessions with minimal human oversight. Combined with agent-to-agent delegation chains, this creates conditions for runaway autonomous operation.

sessions_spawn({
  agentId: "watson",
  task: "Deep dive: analyze competitors A, B, C. Write report to reports/competitors.md",
  runTimeoutSeconds: 7200,
  cleanup: "keep"
})

The skill establishes patterns for agents to directly message other agents (e.g., Watson messaging Picasso) without human-in-the-loop approval, enabling cascading autonomous action chains that bypass user confirmation at each step.

// In Watson's context
sessions_send({
  label: "picasso",
  message: "Create an infographic from data in reports/research.md"
})