The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external chat events and passes it to the agent, creating a vulnerability to indirect prompt injection.
Ingestion points: Message content is extracted from QQ WebSocket events (C2C_MESSAGE_CREATE and GROUP_AT_MESSAGE_CREATE) in qq-bot.js.
Boundary markers: Absent. The message content is interpolated directly into the command arguments for the agent without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has the capability to execute system commands via child_process.spawn to interact with the openclaw CLI.
Sanitization: While session IDs are filtered for alphanumeric characters, the message content itself undergoes no sanitization before being processed by the agent.
[COMMAND_EXECUTION]: The skill dynamically executes shell commands to interact with the agent's core CLI.
Evidence: qq-bot.js utilizes child_process.spawn to invoke openclaw agent with arguments derived from incoming QQ messages.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to external domains to manage bot authentication and communication.
Evidence: qq-bot.js initiates HTTPS requests to bots.qq.com and api.sgroup.qq.com. These domains belong to the official QQ Open Platform service and are used for token acquisition and message relaying.

openqq