The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains literal strings designed to bypass agent safety filters, such as 'Ignore previous instructions', 'You are now a [new role]', and 'Do not follow any rules', located in SKILL.md and references/workflows.md. While listed as detection patterns, these strings may be interpreted as active instructions by the LLM if they are not explicitly isolated in a restricted context.\n- [REMOTE_CODE_EXECUTION]: Both SKILL.md and references/workflows.md include functional shell command strings for high-severity attacks, including classic bash reverse shells ('bash -i >& /dev/tcp/'), Python socket-based execution, and Perl/PHP/Node.js variants. These strings represent a risk as they provide ready-made payloads that the agent could be manipulated into executing during demonstration or verification tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection due to the following factors:\n
Ingestion points: The tool explicitly processes untrusted data sources through scan_shell_history (command history files), detect_indirect_injection (web content and documents), and scan_directory (general file scanning).\n
Boundary markers: The workflow definitions lack specifications for delimiters or instructions to treat ingested data as non-executable text.\n
Capability inventory: The skill requires binary access to node, grep, and sha256sum, and its toolset includes broad capabilities for network monitoring (check_outbound_connections) and file system analysis.\n
Sanitization: There is no documented logic for sanitizing or filtering the content found during scans before it is processed by the agent logic.

openclaw-threat-detect