The Agent Skills Directory

[SAFE]: The skill documentation describes architecture and operational procedures without containing malicious instructions or suspicious code patterns. The content is purely informational and aimed at system administrators.
[NO_CODE]: No scripts, binaries, or active execution instructions are included in the skill. It consists of Markdown files containing text, JSON/YAML configuration examples, and CLI command references.
[INDIRECT_PROMPT_INJECTION]: The skill describes a platform with a significant ingestion surface for untrusted data. While the documentation itself is safe, the system it governs is susceptible to indirect prompt injection via its various communication channels and tool outputs.
Ingestion points: Integrated chat channels (Telegram, WhatsApp, Slack, etc.), external web search results, and MCP (Model Context Protocol) server tool responses, as detailed in references/channels-and-providers.md.
Boundary markers: The architecture supports static system context injection via prependSystemContext and appendSystemContext hooks to reinforce agent instructions, as mentioned in references/concepts.md.
Capability inventory: The platform exposes high-privilege tools including local shell execution (exec), remote device management via Nodes, and multi-agent session spawning (sessions_*), all of which are managed by the tool governance model described in references/tools.md.
Sanitization: Security controls are documented, including SSRF protection for browser tools, origin validation for WebSocket connections, and structured before_install hooks for scanning third-party plugin code.

openclaw