The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill programmatically searches for and reads sensitive authentication tokens from local configuration files, specifically ~/.openclaw/openclaw.json and /data/.clawdbot/openclaw.json. These credentials are then exported into the environment and shared with dynamically spawned sub-agents.
[REMOTE_CODE_EXECUTION]: Sub-agents are explicitly instructed to discover and run test suites found within the target repositories (e.g., executing npm test, pytest, cargo test, or Makefile targets). This behavior allows for the execution of arbitrary, potentially malicious code contained within the repositories being processed.
[PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection. It ingests untrusted data from GitHub issue bodies and PR review comments and interpolates them directly into the task prompts for sub-agents.
Ingestion points: Issue bodies fetched via GitHub API and review comments fetched from multiple sources (PR reviews, inline comments, and PR bodies).
Boundary markers: The skill uses XML-style tags (<issue>, <review_comments>) but lacks explicit instructions to ignore potentially malicious commands embedded within that data.
Capability inventory: Sub-agents possess extensive capabilities including shell access, file system modification, network access via curl with the GH_TOKEN, and the ability to send messages to Telegram.
Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is processed by the LLM.
[DATA_EXFILTRATION]: The skill facilitates data exfiltration by allowing the transmission of repository information and PR details to a Telegram channel specified by the --notify-channel flag. If a sub-agent is compromised via prompt injection, this channel could be used to leak sensitive code or credentials.
[EXTERNAL_DOWNLOADS]: The skill uses curl to interact with the GitHub REST API and git to clone and push code to external repositories. While these target well-known services, the interaction with untrusted third-party codebases during the automation process introduces supply chain risks.
[COMMAND_EXECUTION]: The orchestrator and sub-agents make extensive use of shell command execution, including the use of node -e to dynamically evaluate and extract data from JSON configuration files and the execution of arbitrary repository-defined test scripts.

gh-issues