The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation encourages the use of piped remote script execution.
Evidence: references/docs/install/ansible.md and references/docs/install/index.md instruct users to run curl -fsSL ... | bash from openclaw.ai and GitHub repositories.
Risk: This pattern executes unverified code directly in the system shell.
[COMMAND_EXECUTION]: The AI agent is instructed to run local scripts as part of its operational workflow.
Evidence: SKILL.md contains instructions for the agent to execute ./scripts/update.sh and ./scripts/search-skills.sh.
Context: These scripts are used to rebuild internal indexes and search community skill lists.
[REMOTE_CODE_EXECUTION]: The skill promotes the use of npx for installing third-party extensions.
Evidence: SKILL.md suggests using npx clawdhub@latest install <skill-slug> to install community-built skills.
Risk: Executing code from a remote registry based on user-supplied identifiers without local verification.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its broad data ingestion surface.
Ingestion points: Documentation updates from https://docs.openclaw.ai/*.md (update.sh), community skill metadata (search-skills.sh), and user-supplied error logs.
Boundary markers: Absent. The agent is not instructed to isolate or verify external content.
Capability inventory: The agent can execute scripts and has access to powerful tools (exec, write, browser) via the OpenClaw gateway.
Sanitization: Absent. External data is treated as an authoritative source of truth.
[EXTERNAL_DOWNLOADS]: The skill documents and triggers downloads from external unverified domains.
Evidence: SKILL.md and several documentation files reference downloads from openclaw.ai, raw.githubusercontent.com, and npm.

tool-openclaw