The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The sendCommand function in handler.js contains a command injection vulnerability. It uses execSync with a template literal and performs insufficient escaping by only replacing double quotes. An attacker-controlled command containing shell metacharacters like backticks (`) or $() will be evaluated by the host shell before the command is passed to tmux. For example, a command like $(whoami) would be executed on the host system immediately.
[COMMAND_EXECUTION]: The skill's primary purpose is the execution of arbitrary shell commands provided by the agent. The safety mechanism in isDangerous uses a simple lowercase string-matching blacklist (sudo, rm, etc.) with leading and trailing spaces, which is trivial to bypass using common shell techniques (e.g., rm/*, SUDO, or \rm).
[PROMPT_INJECTION]: The SKILL.md and SAFETY.md files include extensive instructions designed to override the agent's default safety behavior or guide its decision-making in adversarial scenarios. These include specific rules for handling obfuscated commands, environment variables, and social engineering attempts, which act as secondary system prompts.
[DATA_EXFILTRATION]: The skill facilitates data exfiltration by allowing the agent to run network-capable commands (like curl) and pipe local system data to external endpoints. While the instructions advise against this, the technical implementation in handler.js does not prevent it.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection (Category 8):
Ingestion points: The readOutput() function in handler.js reads the content of a tmux pane and returns it to the agent.
Boundary markers: There are no markers or delimiters wrapping the retrieved output to distinguish it from agent instructions.
Capability inventory: The skill has the capability to execute shell commands via execSync as implemented in handler.js.
Sanitization: No sanitization or filtering is performed on the data captured from the tmux session before it is returned to the agent context.

claw-shell-hardened