The Agent Skills Directory

[COMMAND_EXECUTION]: The PicoClaw framework provides an exec tool for shell command execution and a hooks system that can trigger external processes.
Evidence: references/tools.md describes tools.exec for shell execution, which includes configurable guardrails like enable_deny_patterns and custom_deny_patterns.
Evidence: references/hooks.md describes out-of-process hooks using command arrays (e.g., ["python3", "/tmp/review_gate.py"]) to run arbitrary scripts.
Evidence: references/cron.md notes that cron jobs can execute commands gated by tools.exec policy.
[REMOTE_CODE_EXECUTION]: The skill supports installing additional agent skills from remote GitHub repositories and specialized registries, as well as adding MCP servers.
Evidence: references/skills.md details the command picoclaw skills install <owner>/<repo>/<skill-folder> for fetching and adding skills to the workspace.
Evidence: references/skills.md details installation from registries configured under tools.skills.registries.
Evidence: references/tools.md mentions picoclaw mcp add for adding Model Context Protocol servers which can execute local or remote code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user input from a wide variety of third-party communication platforms, creating a broad surface for indirect prompt injection attacks.
Ingestion points: Telegram, Discord, Slack, WhatsApp, WeCom, LINE, and OneBot channels as described in references/channels.md, along with web search results and MCP server outputs.
Boundary markers: Use of allow_from for peer IDs provides access control, but the documentation does not specify explicit instruction delimiters to isolate untrusted user data from agent logic.
Capability inventory: The agent has high capabilities including command execution via the exec tool, persistence via the cron service, and network access via web search tools and outbound webhooks.
Sanitization: references/troubleshooting.md mentions that release v0.2.9 includes fixes for Gemini MCP schema sanitization.
[DATA_EXFILTRATION]: The system manages sensitive credentials and supports outbound communication channels that could be leveraged to send data to external targets.
Evidence: references/auth.md and references/config.md discuss the storage of API keys and OAuth tokens in ~/.picoclaw/auth.json and .security.yml.
Evidence: references/channels.md describes the teams_webhook channel, which is an output-only channel designed for sending notifications to external Microsoft Teams targets.
[PERSISTENCE]: The integrated cron service allows for the scheduling of recurring tasks that persist across process restarts.
Evidence: references/cron.md describes the picoclaw cron add command for creating scheduled jobs based on time intervals or cron expressions.
[TIME_DELAYED_CONDITIONAL]: The skill includes a cron-based scheduler capable of executing commands at specific times or intervals, which could be used to gate malicious behavior.
Evidence: references/cron.md defines scheduled job execution via picoclaw cron add and mentions tools.cron.exec_timeout_minutes for bounding executions.
[CREDENTIALS_UNSAFE]: The skill's primary function includes the local storage and management of authentication secrets in configuration files.
Evidence: references/auth.md states that credentials from various providers (OpenAI, Anthropic, Google) are stored in ~/.picoclaw/auth.json.
Evidence: references/config.md describes .security.yml as a file for storing sensitive API keys and tokens separate from the main configuration.
[DYNAMIC_EXECUTION]: The hook system and MCP integration allow for the dynamic loading and execution of external scripts and servers at runtime.
Evidence: references/hooks.md details out-of-process hooks that run JSON-RPC over stdio using arbitrary commands.
Evidence: references/tools.md describes the serial hardware tool which allows for direct interaction with attached hardware devices.

picoclaw