The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes messages from the WeChat network and forwards them to the AI agent, creating a pathway for external untrusted input to influence agent behavior.
Ingestion points: Incoming messages are captured in scripts/wechat-bridge.js via the bot.on('message') event handler.
Boundary markers: The skill does not implement delimiters (e.g., XML tags or triple quotes) or explicit 'ignore embedded instructions' warnings when forwarding message content to the OpenClaw gateway.
Capability inventory: The skill possesses the ability to send text, images, and local files to WeChat users/groups, and can perform network requests to the OpenClaw gateway via axios.
Sanitization: The script performs basic text cleaning (removing @mentions) but does not validate or escape the content to prevent prompt injection attacks.
[DATA_EXFILTRATION]: The integrated Express API provides a mechanism to transmit local filesystem content to external WeChat recipients.
The /api/send endpoint in scripts/wechat-bridge.js accepts a path parameter for image and file types, which it uses to read local files via FileBox.fromFile(path). While this is an intended feature supporting the skill's purpose, it provides a direct vector for exfiltrating sensitive local data if the API endpoint or the agent is misused.
[COMMAND_EXECUTION]: The skill instructions involve the execution of shell commands to set up the environment and run the bridge service.
SKILL.md and package.json guide the user to perform npm install and execute node scripts/wechat-bridge.js. These are standard operational requirements for a Node.js-based skill but involve executing code in the host environment.

wechat-channel