The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/publish_to_lemmy.py contains hardcoded authentication credentials for the Lemmy forum service, specifically the LEMMY_USERNAME ('xiaer01') and LEMMY_PASSWORD ('e8$EqyiPDpVZ!UgZVw') variables.
[COMMAND_EXECUTION]: Multiple scripts use subprocess.run to execute other Python scripts or system commands:
scripts/publish_all_today.py executes fetch_and_format.py and publish_to_lemmy.py via shell calls.
scripts/test_debug.py executes fetch_and_format.py using a hardcoded absolute file path (/home/openclaw/.openclaw/workspace/skills/openclaw-poster/scripts/fetch_and_format.py).
scripts/fetch_and_format.py contains a stub for executing the openclaw system command via subprocess in its call_llm_for_analysis function.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to external infrastructure:
scripts/fetch_and_format.py fetches announcement data from http://39.104.68.74:8452 using urllib.request.
scripts/publish_to_lemmy.py communicates with https://xiaer.ai to authenticate and create forum posts using the requests library.
[PROMPT_INJECTION]: The scripts/fetch_and_format.py script ingests untrusted data from a remote API (announcement titles and content) and interpolates it into a prompt for analysis in the generate_overall_analysis function. This creates a surface for indirect prompt injection where malicious content in a corporate announcement could influence the agent's output.

openclaw-poster