The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/send-daily-quote.sh reads quote data from references/quotes.md and interpolates it into the $SCRIPT variable. This variable is then expanded inside double quotes in a shell command to execute the sag tool. Because of how the shell handles expansion, if the quote file contains command substitution patterns such as $(...) or `...`, those commands will be executed with the privileges of the script runner.
[EXTERNAL_DOWNLOADS]: The SKILL.md metadata defines a dependency on the sag ElevenLabs CLI tool installed via the third-party Homebrew tap steipete/tap/sag. Fetching and executing binaries from personal or unverified third-party repositories introduces a significant supply chain risk, as the integrity and safety of the downloaded code cannot be guaranteed.
[EXTERNAL_DOWNLOADS]: The skill attempts to execute an image generation script at a hardcoded absolute path: /opt/homebrew/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py. Relying on external, unmanaged scripts located outside the skill's own directory structure can lead to the execution of unintended or malicious code if that path is writable by other users or processes.

daily-voice-quote