The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection through shell interpolation of untrusted data extracted from messaging platforms.
Evidence: In Step 4 of the recovery workflow, keywords extracted from messaging history (Discord, Slack, etc.) are used in a shell command: grep -ri "<keyword>" ~/.openclaw*/memory/.
Evidence: A malicious user could craft a message containing shell metacharacters (e.g., ;, |, or $(...)) to execute arbitrary commands when the context recovery process is triggered.
[DATA_EXFILTRATION]: The skill accesses sensitive conversation logs and memory files across all agent profiles, resulting in broad data exposure.
Evidence: Step 3 uses the glob pattern ~/.openclaw*/agents/*/sessions/*.jsonl to read full conversation history from all agents and profiles on the system.
Evidence: Step 4 and Step 6 access the shared ~/.openclaw*/memory/ directory, which may contain private information from other sessions or agents.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and injects it into the agent's context without sufficient safety boundaries.
Ingestion points: Messaging history fetched via the message:read tool from Discord, Slack, Telegram, and Signal (documented in Step 2).
Boundary markers: The skill lacks robust delimiters or explicit instructions to ignore commands embedded within the retrieved messages when synthesizing the context summary.
Capability inventory: The skill has permissions for shell command execution (exec), file system writes (file_write), and messaging API access (network).
Sanitization: While the skill mentions redacting secrets, it does not sanitize the text for malicious instructions that could hijack the agent's behavior.

context-recovery