The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local bash scripts (select-model.sh, pool.sh, hud.sh) and external CLIs using user-provided task descriptions. Examples show tasks being interpolated directly into shell commands (e.g., "$SKILL/select-model.sh" "$TASK"), which can lead to command injection if the input contains malicious shell characters.
[DATA_EXFILTRATION]: The skill is designed to access sensitive local credential files, specifically ~/.codex/auth.json and ~/.codex-acct2/auth.json, which store ChatGPT/Codex OAuth session tokens.
[DATA_EXFILTRATION]: It implements a 'Bridge Notification' system that sends session details—including task summaries, prioritized actions, and identified risks—to an external endpoint via openclaw system event using a HOOKS_TOKEN bearer token.
[COMMAND_EXECUTION]: The instructions explicitly guide the agent to modify the user's shell profile (~/.zshrc) to persist configuration variables such as ZAI_CODING_PLAN, which alters the user's permanent environment.
[REMOTE_CODE_EXECUTION]: The skill automates the installation and execution of external binaries and packages (e.g., brew install codex, npm install -g @openai/codex, jq) based on runtime routing decisions.
[PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface.
Ingestion points: User-supplied task descriptions and natural language commands enter the context through the /ohmyclaw command and automated activation rules.
Boundary markers: Examples sporadically use single quotes for task parameters, but there are no consistent instructions to ignore embedded commands or utilize secure delimiters.
Capability inventory: The skill utilizes full shell execution (bash pty:true), sensitive file access (OAuth tokens), and network communication (bridge hooks).
Sanitization: No explicit input validation, escaping, or sanitization logic is provided for task strings before they are processed by the shell-based routing engine.

ohmyclaw