The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses local configuration files at ~/.openclaw/openclaw.json and /data/.clawdbot/openclaw.json to retrieve the GH_TOKEN. It also configures git remotes using the token in the URL (https://x-access-token:$GH_TOKEN@github.com/...), which can cause the token to be stored in plain text within the .git/config file.
[COMMAND_EXECUTION]: The orchestrator and its sub-agents execute arbitrary shell commands including git, curl, and node to perform repository operations and interact with the GitHub API. This includes dynamic script execution via node -e to process configuration data.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests untrusted data from GitHub issue bodies and PR review comments and interpolates them into sub-agent prompts.
Ingestion points: GitHub issue metadata ({title}, {body}) and review comments ({json_array_of_actionable_comments}).
Boundary markers: Uses <issue> and <review_comments> XML-style tags to delimit untrusted content, but lacks explicit instructions to ignore potentially malicious instructions embedded in that data.
Capability inventory: Sub-agents possess full shell access, file system write permissions, and network access via the GitHub API.
Sanitization: There is no evidence of sanitization or filtering performed on external content before it is processed by sub-agents.

gh-issues