The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit instructions for the AI agent to bypass its own security and permission system.
File pipeline/LOOP-PROMPT.md contains the instruction to run the CLI with elevated risk: claude -p --dangerously-skip-permissions --model sonnet.
File LOOP.md similarly instructs the agent to use the --dangerously-skip-permissions flag during the generation phase.
[PRIVILEGE_ESCALATION]: The instruction to use --dangerously-skip-permissions is a direct attempt to escalate the agent's privileges by skipping necessary human-in-the-loop approvals for sensitive operations (file writes, command execution).
[PERSISTENCE]: The skill provides detailed instructions to set up automated, recurring execution cycles that maintain access and activity on the host system.
File OPENCLAW-SETUP.md instructs the creation of a recurring cron job (0 */3 * * *) that automatically clones the repository and executes the agent loop every 3 hours.
[COMMAND_EXECUTION]: The skill's architecture relies on executing a wide range of shell commands to manage its lifecycle.
Files LOOP.md and LOOP-PROMPT.md describe workflows involving git clone, npm install, claude plugin install, and git push.
[INDIRECT_PROMPT_INJECTION]: The skill presents a significant vulnerability surface where untrusted AI-generated HTML artifacts are evaluated, and the results are used to automatically modify the skill's own core instructions (SKILL.md).
In pipeline/LOOP-PROMPT.md (Step 4), the agent is told: "Critical: Fix the SKILL, not the outputs." This creates a feedback loop where a poisoned artifact containing hidden instructions could influence the agent to rewrite its own source code maliciously.
[DYNAMIC_EXECUTION]: The orchestrator script pipeline/run.js uses the Playwright library to execute arbitrary JavaScript within a browser context using page.evaluate. This is used to analyze generated content, which may include untrusted scripts.

evaluate