The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and integrate files (SKILL.md and source code) from external host repositories into the local core bundle, which creates a surface for prompt-based attacks.
Ingestion points: The workflow copies the full contents of a skill directory and paired source files from a user-specified path (--from <host-repo-root>) into the active environment.
Boundary markers: The skill relies on human editorial review and automated regex-based linting, but lacks programmatic prompt boundaries (e.g., delimiters) to prevent the agent from potentially obeying instructions embedded within the harvested files.
Capability inventory: The skill is capable of writing files to the local filesystem (skills/ directory) and modifying the openclaw.plugin.json configuration file.
Sanitization: The skill employs a privacy linter to identify and scrub PII (emails, Slack channels, names) from the harvested content, which serves as a security control but does not address malicious prompt instructions.
[COMMAND_EXECUTION]: The workflow involves the execution of shell commands (gbrain, bun test, git diff) that incorporate user-provided inputs such as the skill slug and host repository path.
Evidence: The skill instructions prompt the agent to run commands like gbrain skillpack harvest <slug> --from <host-repo-root>. If these variables are not properly validated by the execution environment, they could potentially serve as a vector for command injection.

skillpack-harvest