The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to read and export sensitive credentials from the host file system. \n
Evidence: SKILL.md provides code to extract the api_key and api_base from ~/.gooseworks/credentials.json for use in API authentication.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of external software and command-line tools. \n
Evidence: Recommends global installation of the @orth/cli package via npm install -g.\n
Evidence: Mentions usage of npx goose-skills and npx gooseworks tools.\n- [REMOTE_CODE_EXECUTION]: The skill allows for the dynamic download and deployment of additional agent instructions and potential scripts. \n
Evidence: The orth skills add command downloads and installs new skills into ~/.openclaw/skills/, which the agent is then instructed to read and follow.\n- [COMMAND_EXECUTION]: The skill relies on shell command execution to parse configurations and interact with system tools. \n
Evidence: Uses python3 -c to extract API keys from local JSON files and executes various shell commands via the orth CLI.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from the Orthogonal library which could be manipulated to influence agent behavior. \n
Ingestion points: Output from orth skills search, orth skills list, and orth skills info commands in SKILL.md.\n
Boundary markers: Absent; there are no instructions to the agent to treat external skill descriptions or metadata as potentially untrusted.\n
Capability inventory: Global package installation (npm), shell execution (python3, orth), and local file access (cat, orth skills add).\n
Sanitization: Absent; the skill does not define validation or filtering for data retrieved from the remote skill library.

find-skill