The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation in references/deployment.md recommends an installation method that downloads and executes a remote script directly: curl -fsSL https://openclaw.ai/install.sh | bash.
[REMOTE_CODE_EXECUTION]: The references/advanced-tools.md file describes an exec tool designed to allow the agent to run arbitrary shell commands within the configured environment.
[CREDENTIALS_UNSAFE]: The references/config-schema.md reveals that sensitive authentication data, including gateway tokens and messaging bot tokens (Telegram/WhatsApp), are stored in plaintext within the openclaw.json configuration file.
[COMMAND_EXECUTION]: The unified management script scripts/openclaw.sh and the CLI documented in references/cli-full.md provide extensive control over the system, including daemon service management, plugin installation, and system-wide configuration resets.
[PROMPT_INJECTION]: The skill has a high surface area for indirect prompt injection due to its integration with untrusted external data sources.
Ingestion points: Data entering from messaging channels (WhatsApp, Telegram, Discord) as seen in references/cli-full.md, and web content retrieved via the managed Playwright browser.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions embedded in external data.
Capability inventory: The skill provides capabilities for arbitrary command execution (exec tool), background service control, and file system access.
Sanitization: There is no evidence of input validation or sanitization for data processed from messaging nodes or browser snapshots.

openclaw