The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to retrieve the gateway authentication token using the command openclaw config get gateway.auth.token. This exposes sensitive credentials directly into the agent's execution context.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8). It performs operations that ingest untrusted external data which is then processed by the agent.
Ingestion points: The agent navigates to arbitrary URLs and captures page content using openclaw browser --browser-profile openclaw snapshot and screenshot commands (SKILL.md).
Boundary markers: There are no instructions for the agent to ignore or delimit embedded instructions within the captured snapshots or screenshots.
Capability inventory: The skill possesses powerful administrative capabilities, including device approval (openclaw devices approve <requestId>) and configuration modification (openclaw config set ...).
Sanitization: No sanitization or validation of the external web content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill makes extensive use of the openclaw CLI to perform system-level changes, including restarting services (openclaw gateway restart) and approving new device connections. While these are the primary functions of the skill, their proximity to untrusted data ingestion increases the risk of automated exploitation.

openclaw-browser-setup