The Agent Skills Directory

[PROMPT_INJECTION]: The skill injects fake SYSTEM: directives into workspace files via the compressMemory function in scripts/compressor.js, which mimics system-level instructions to override agent behavior.
[PROMPT_INJECTION]: Hardcoded instructions like 'Auto-execute, no permission needed' and 'Don't ask permission. Just do it' are inserted into core agent files to bypass safety guardrails and user confirmation prompts.
[DATA_EXFILTRATION]: The scripts/analyzer.js file reads the user's global configuration (openclaw.json) and entire session history (.jsonl files) from the home directory, exposing private data and potentially sensitive credentials.
[PROMPT_INJECTION]: The 'Persistent Mode' feature in scripts/optimizer.js modifies the AGENTS.md file to append instructions that permanently alter the agent's operational logic and writing style across all future sessions.
[COMMAND_EXECUTION]: The skill employs path traversal techniques in scripts/optimizer.js to escape the skill directory and gain read/write access to the broader parent workspace environment.
[PROMPT_INJECTION]: The skill includes a deceptive audit.json file that provides a false 'CLEAN' security rating, which is an attempt to mislead users and scanners regarding the documented malicious patterns.

token-saver