The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is instructed to search for and extract the GH_TOKEN or apiKey from local configuration files (~/.openclaw/openclaw.json and /data/.clawdbot/openclaw.json) if the environment variable is missing. These files are sensitive and contain credentials for the platform.
[DATA_EXFILTRATION]: The skill instructs sub-agents to embed the resolved GH_TOKEN directly into Git remote URLs (e.g., https://x-access-token:$GH_TOKEN@github.com/...). This practice stores the credential in plain text within the local .git/config file and can lead to exposure in command-line history, process logs, or when the repository is shared.
[INDIRECT_PROMPT_INJECTION]: The orchestrator fetches untrusted content (issue titles and bodies) from GitHub and interpolates them directly into sub-agent task prompts. There are no boundary markers or instructions for the sub-agents to ignore embedded commands, allowing a malicious issue to potentially hijack the sub-agent's execution.
- Ingestion points: GitHub issue title and body fetched in Phase 2.
- Boundary markers: None; the {body} and {title} are injected raw into the sub-agent prompt.
- Capability inventory: File system access (git), network access (curl), and the ability to spawn further agents (sessions_spawn).
- Sanitization: None; external content is interpolated directly into instructions.
[DYNAMIC_EXECUTION]: The sub-agent instructions include the use of node -e to execute one-liner scripts that programmatically parse local JSON configuration files to retrieve credentials at runtime.

gh-issues