The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to construct and execute shell commands using variables provided by the user, specifically the skill 'slug' and the 'host-repo-root' path. There is no explicit instruction for the agent to sanitize these inputs before execution, which could allow for command injection if the inputs contain shell control characters (e.g., semicolons, ampersands, or pipes) that are interpreted by the host shell.
Evidence: gbrain skillpack harvest <slug> --from <host-repo-root>
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external file content (including SKILL.md, routing-eval.jsonl, and TypeScript source files) from a host repository into the core project. This behavior introduces a surface for indirect prompt injection where malicious instructions or triggers within the harvested files could be promoted into the main system's bundle, potentially influencing subsequent agent actions or system behavior.
Ingestion points: SKILL.md, routing-eval.jsonl, and paired source files located in the <host-repo-root>/skills/<slug>/ directory.
Boundary markers: The skill does not employ specific delimiters or explicit instructions to the agent to ignore potentially malicious embedded instructions during the ingestion process.
Capability inventory: The workflow involves writing files to the skills/ directory, modifying the openclaw.plugin.json configuration file, and executing tests via bun test on the newly added content.
Sanitization: The skill implements a regex-based 'privacy linter' and a manual editorial checklist to remove sensitive personal data, but these measures are primarily focused on privacy and do not account for adversarial prompt injection or malicious code patterns.

skillpack-harvest