The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill scans untrusted content from files in the core, native, and community skill directories and includes matched text snippets in its audit reports. A malicious skill could craft a payload (e.g., a fake credential or injection string) that acts as an instruction to the agent when the audit summary is processed.
Ingestion points: The audit.py script recursively reads text and binary data from all files in the configured skills directories to perform pattern matching and hashing.
Boundary markers: The audit results are presented in a structured text report, but the detail field containing file content matches is not enclosed in specific security delimiters or escaped to prevent the agent from interpreting it as instructions.
Capability inventory: The skill has permissions to read all files in the agent's extensions directory and write state information to the local file system (~/.openclaw/). It does not have network access or administrative privileges.
Sanitization: The script truncates regex matches to 60 characters in the output, which significantly limits the length of potential injection payloads but does not eliminate the risk of short, high-impact instructions being followed.

installed-skill-auditor