The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses a sensitive credential file located at a hardcoded absolute path: /root/.openclaw-claw2/credentials/github_token. This token is used to authenticate requests to the GitHub API. While necessary for the skill's stated purpose of managing repository issues, hardcoded access to system-level credential paths is a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill fetches external YAML files from a remote GitHub repository and explicitly instructs the agent to "strictly follow the correct_process steps" found within that data. This creates a vulnerability where a compromised or malicious repository could provide instructions that the agent executes without further validation.
Ingestion points: External YAML 'Capsules' are downloaded from https://raw.githubusercontent.com/BENZEMA216/openclaw-pitfalls/main/capsules/PIT-XXX.yaml in SKILL.md.
Boundary markers: None. The skill contains no delimiters or instructions to ignore potential commands embedded in the fetched YAML files; instead, it encourages direct obedience.
Capability inventory: The skill has access to curl and python3, enabling network communication and local script execution (e.g., scripts/submit_capsule.py).
Sanitization: There is no evidence of validation or sanitization of the fetched YAML content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill utilizes shell commands via curl and python3 to interact with APIs and local files. While the automated scanner flagged curl | python3 as remote code execution, manual inspection confirms these instances are used safely for parsing JSON data using python3 -c rather than executing remote scripts.

pitfall-experience