The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a bash script that queries system environment variables and tool versions to identify the runtime environment.
Evidence: scripts/detect.sh uses commands like pwd, bun --version, and node --version, and checks for environment variables such as VERCEL_SANDBOX_ID and CLAUDE_CODE.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the execution environment (environment variables and directory paths) and interpolates it into the agent's context, creating a potential attack surface.
Ingestion points: Environment variables (VERCEL_SANDBOX_ID, CLAUDE_CODE) and the current working directory captured in scripts/detect.sh.
Boundary markers: None are used to separate environment metadata from other prompt instructions in the script's output.
Capability inventory: The skill assumes access to a shell (bash), file tools (readFile, writeFile), and tool discovery mechanisms (skill).
Sanitization: Data is formatted as JSON but lacks specific sanitization or filtering of the variable contents.
[OBFUSCATION]: The manifest file .clawnet/unsigned-skill.json contains a large hex-encoded string representing the skill's content.
Evidence: The opReturnHex field encodes a Bitcoin-based protocol header followed by the markdown content of SKILL.md. Analysis shows this is a standard format for on-chain skill registration and does not appear to be used for concealing malicious intent.

runtime-context