The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface. It dynamically builds system prompts for sub-agents using data from external sources. \n
Ingestion points: Project file scanning during initialization and monitoring of the chat.md communication log. \n
Boundary markers: Not explicitly defined for project data; chat.md relies on regex patterns which do not prevent malicious instruction execution. \n
Capability inventory: The skill can spawn new agent sessions with custom prompts, execute local bash scripts, and write to the filesystem. \n
Sanitization: No evidence of content escaping or validation before interpolation into agent prompts. \n- [COMMAND_EXECUTION]: The skill uses several bash scripts to manage its local registry at ~/.openclaw/, scan for .git repositories, and build the communication server. These operations involve direct interaction with the host filesystem. \n- [REMOTE_CODE_EXECUTION]: The scripts/build.sh file contains a help message referencing the curl | sh pattern for installing the Rust toolchain from https://sh.rustup.rs. While Rust is a well-known technology, this pattern represents a high-risk remote code execution vector. \n- [EXTERNAL_DOWNLOADS]: During the build phase, the skill uses the standard Rust package manager (cargo) to download dependencies from the official crates.io registry.

workplace