The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill triggers the global installation of the clawhub Node.js package from the public npm registry.\n- [REMOTE_CODE_EXECUTION]: The clawhub install and clawhub update commands retrieve agent skill configurations from https://clawhub.com. These skills contain instructions and logic executed by the agent, representing a mechanism for remote code execution from an external source.\n- [DATA_EXFILTRATION]: The clawhub publish command transmits local directory content to the remote registry at https://clawhub.com. This functionality facilitates the transfer of local data to an external server.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute various shell commands for software installation (npm i), authentication (clawhub login), and skill synchronization.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data via clawhub install and clawhub update (SKILL.md). There are no boundary markers or instructions to ignore embedded commands. The skill possesses extensive capabilities including package installation and file transmission (SKILL.md). No sanitization or validation of the downloaded skill content is performed before execution.

clawhub