The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill features a plugin system that allows users to install and test 'portable plugins' using the --trust-code flag. These plugins are executed as child processes with the user's OS permissions, which facilitates the execution of arbitrary local code.
[EXTERNAL_DOWNLOADS]: The skill documentation directs users to install the Wrench CLI from a GitHub repository (github:hraness/wrench). Additionally, the WhatsApp adapter setup script (install-whatsapp-protocol.sh) downloads and verifies an external binary from github.com/openclaw/wacli.
[COMMAND_EXECUTION]: The skill relies extensively on executing shell commands for operations such as plugin management, authentication login, and web capture, which provides a broad execution surface.
[DATA_EXFILTRATION]: The skill is designed to capture signed-in web pages, archive media, and query messaging views. While the primary purpose is 'local-first', these capabilities can be leveraged to exfiltrate sensitive data if the agent is compromised.
[CREDENTIALS_UNSAFE]: The skill accesses and manages sensitive browser data, including cookies and profile snapshots from browsers like Arc and Chrome, to maintain authenticated sessions for various web platforms.
[PROMPT_INJECTION]: The skill processes untrusted content from external websites and messaging services, creating a surface for indirect prompt injection. \n
Ingestion points: Web scraping via wrench read, URL clipping, and unified inbox reads (wrench omni read). \n
Boundary markers: The instructions mention 'bounded semantic operations' and 'risk boundaries', but do not explicitly define delimiters to separate ingested data from agent instructions. \n
Capability inventory: Shell command execution (wrench), network operations, and file system modifications. \n
Sanitization: While the skill mentions sanitizing derivation evidence and checking plugin manifests, it lacks explicit details on sanitizing arbitrary web content processed at runtime.

wrench