The Agent Skills Directory

[COMMAND_EXECUTION]: The skill registers a scheduled task (persistence) that periodically executes shell commands. The default template includes tail, ps aux, pkill, and df. Furthermore, the skill's instructions explicitly encourage the agent to execute any check listed in the HEARTBEAT.md file using shell execution.
[DATA_EXFILTRATION]: The heartbeat mechanism is configured to read from ~/nanoclaw/logs/errors.log. Accessing logs in the user's home directory can expose sensitive system information, environment variables, or application data.
[DYNAMIC_EXECUTION]: The skill generates an IPC (Inter-Process Communication) task file at data/ipc/main/tasks/heartbeat_$(date +%s).json. This file contains a prompt that instructs the agent to dynamically parse and execute shell commands found within a markdown file at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from an external file (HEARTBEAT.md) and executes instructions contained within it.
Ingestion points: Reads instructions and commands from $GHOSTCLAW_GROUP_DIR/HEARTBEAT.md or ./HEARTBEAT.md.
Boundary markers: None identified. The agent is instructed to "run each check listed" without validation or isolation between instructions and data.
Capability inventory: Full shell execution capabilities including process management (pkill), file system access (tail, df), and suggested network operations (curl).
Sanitization: No sanitization or validation of the commands in the checklist file is performed before execution.

add-heartbeat