The Agent Skills Directory

[DATA_EXFILTRATION]: The skill extracts authentication tokens and session cookies from local configuration files and transmits them to external endpoints via network requests.
Sensitive File Access: Reads authentication tokens from /home/aa/.openclaw/chrome-profiles/provider-session.json and session cookies from /home/aa/.openclaw/chrome-profiles/your-provider-session.json.
Credential Transmission: Sends extracted tokens in the Authorization: Bearer header to https://ai.9w7.cn/api/user/info and session cookies in the Cookie header to https://your-provider.example.com/api/user/info using curl.
Profile Sharing: Accesses and maintains a unified Chrome profile at ~/.openclaw/browser/openclaw/user-data/, which contains shared login states across all platforms for all agents.
[COMMAND_EXECUTION]: The skill uses shell commands and scripting to process sensitive data and perform network operations.
Local Processing: Executes python3 -c to parse JSON files and extract sensitive strings like tokens and cookies for immediate use in commands.
Network Tools: Uses curl to interact with remote APIs while embedding extracted credentials directly in the command arguments.
CLI Integration: Invokes the GitHub CLI (gh auth status) to verify the local authentication state.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external websites which could potentially influence agent behavior.
Ingestion Points: Captures page snapshots and compact text representations using browser(action='snapshot') from community platforms and social media sites including LinuxDo, X (Twitter), and Reddit.
Capability Inventory: The agent has the capability to execute shell commands, read local files, and navigate to arbitrary URLs, creating a risk if instructions are found within the captured text.
Sanitization & Boundaries: There is no evidence of content sanitization or the use of strict boundary markers to separate retrieved data from instructions before the agent evaluates the content for login indicators.

auth-manager