The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation section instructs users to clone a repository from a third-party account (github.com/reedchris43/openclaw-tool-call-viewer-2026.git) that does not match the known naming patterns for the skill author (Aradotso).
[COMMAND_EXECUTION]: The documentation provides shell commands to download and serve the external code locally using interpreters such as Python (python3 -m http.server), Node.js (npx http-server), and PHP (php -S), which facilitates the deployment of third-party code on the local network.
[PROMPT_INJECTION]: The JavaScript rendering logic in the renderToolCalls and initViewer functions uses the unsafe .innerHTML property to insert data from session logs (e.g., call.tool_name, call.id). This creates a vulnerability to DOM-based Cross-Site Scripting (XSS) if the tool call data contains malicious payloads.
Ingestion points: Reads session data from JSON objects or external files (/data/sessions/session-001.json) that represent tool call logs.
Boundary markers: None; the log data is directly interpolated into HTML template literals.
Capability inventory: The script performs DOM manipulation and can execute arbitrary scripts via the innerHTML sink if processing malicious tool outputs.
Sanitization: None; the implementation lacks HTML escaping or sanitization for fields like tool_name or status before rendering.

openclaw-tool-call-viewer-2026