pitfall-experience

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt tells the agent to read a GitHub API token from /root/.openclaw-claw2/credentials/github_token and use it in Authorization headers (e.g., GITHUB_TOKEN=$(cat ...); curl -H "Authorization: token $GITHUB_TOKEN" ...), which requires the agent to handle and embed a secret in requests and thus creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflow (SKILL.md Phase 1 steps) explicitly fetches and reads user-generated content from a public GitHub repo (e.g., curl to https://api.github.com/repos/BENZEMA216/openclaw-pitfalls/contents and raw.githubusercontent.com/.../capsules/PIT-XXX.yaml) and Phase 2 instructs the agent to "strictly" follow the capsule's correct_process steps, meaning untrusted third-party content is read and can directly determine actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill performs runtime fetches from the repository (e.g. https://raw.githubusercontent.com/BENZEMA216/openclaw-pitfalls/main/capsules/PIT-XXX.yaml and https://api.github.com/repos/BENZEMA216/openclaw-pitfalls/contents/capsules or the repo https://github.com/BENZEMA216/openclaw-pitfalls) and then strictly follows the fetched "correct_process" steps, so external content directly controls the agent's instructions at runtime.