The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses a highly sensitive file containing a GitHub API token located at the path /root/.openclaw-claw2/credentials/github_token.
[DATA_EXFILTRATION]: The skill reads the local GitHub token and transmits it to the GitHub API via Authorization headers for search and issue creation operations.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting YAML 'Capsules' from a remote GitHub repository and explicitly instructing the agent to 'strictly follow' the procedures in the correct_process field and 'not to exercise your own judgment'. This overrides the agent's reasoning capabilities in favor of potentially malicious remote content.
Ingestion points: SKILL.md fetches content from raw.githubusercontent.com and api.github.com in Phase 1.
Boundary markers: Absent; the skill explicitly directs the agent to follow the instructions verbatim.
Capability inventory: The skill has access to shell execution (curl, python3) and file system access.
Sanitization: None; the agent is instructed to obey the remote content without validation.
[COMMAND_EXECUTION]: The skill executes shell commands that pipe remote content from the GitHub API into a Python interpreter. Automated scans detected execution patterns where remote repository data is processed directly by python3.
[EXTERNAL_DOWNLOADS]: The skill fetches directory listings, README files, and configuration data from the author's public GitHub repository (BENZEMA216/openclaw-pitfalls).

pitfall-experience