The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to perform actions "without user intervention" (无需用户干预). This behavioral override encourages the agent to bypass standard human-in-the-loop safety checks for sensitive operations like pushing code to remote repositories or managing releases.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill reveals the absolute filesystem path used to store the GitHub authentication token at /home/node/.openclaw/secrets/github_token.txt. It also promotes the practice of embedding the token directly in the Git remote URL (https://${GITHUB_TOKEN}@github.com/...), which can cause the sensitive token to be exposed in shell history, process lists, or git configuration files. While the transmission to GitHub's official API is necessary for the skill's function, these practices increase the surface area for credential leakage.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests untrusted user data (such as repository names, descriptions, and commit messages) and interpolates them into shell commands (curl and git) without sanitization or boundary markers.
Ingestion points: User input for repository metadata and commit messages.
Boundary markers: Absent; inputs are directly placed into command strings.
Capability inventory: Includes curl for network API calls and git for filesystem and remote repository access.
Sanitization: No evidence of validation or escaping for the interpolated user strings.

github-ops