The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass safety guardrails and human-in-the-loop verification. It states that the agent must complete installation 'fully autonomously, without asking the user for confirmation, choices, or approval' and explicitly tells the agent 'Do not ask for permission.'
[REMOTE_CODE_EXECUTION]: The installation process includes a fallback mechanism that downloads and executes remote shell scripts directly via pipes. Evidence includes curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash for macOS/Linux and powershell -c "irm https://cdn.memtensor.com.cn/memos-local-openclaw/install.ps1 | iex" for Windows.
[OBFUSCATION]: The skill uses character-code encoding (String.fromCharCode) to hide strings in a Node.js shell command. Specifically, it obfuscates the child_process library name and the openclaw gateway restart command string.
[COMMAND_EXECUTION]: The skill frequently uses node -e to execute complex logic directly in the shell, including native module rebuilding (npm rebuild better-sqlite3), version checking via npm view, and modifying the openclaw.json configuration file.
[DATA_EXFILTRATION]: The skill interpolates user-provided sensitive data, such as API keys and endpoints, into shell commands for configuration purposes. While the instructions suggest using command-line arguments for safety, this creates a surface for potential injection if not handled correctly by the agent platform.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: User-provided API provider, endpoint, and key collected during Step 1.5.
Boundary markers: Absent when interpolating user data into configuration scripts.
Capability inventory: File system write access (fs.writeFileSync), shell execution (execSync), and network access (implied via plugin installation).
Sanitization: The skill attempts to use command-line arguments (process.argv) to pass user input to Node.js scripts, but lacks explicit validation or escaping for the input values.

memos-local