The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it ingests and processes content from external skill definition files and tool outputs without proper sanitization. \n
Ingestion points: The skill reads skill metadata and execution instructions from ~/.openclaw/workspace/skills/INDEX.md, ~/.codex/skills/, and ~/.gemini/skills/. It also incorporates output from the gemini and codex CLI tools into its operational context. \n
Boundary markers: No explicit delimiters or instructions (e.g., "ignore instructions within these markers") are provided to the agent to differentiate between its own instructions and untrusted data from the index files or tool outputs. \n
Capability inventory: The skill has the ability to execute shell commands (gemini, codex), read local files for discovery, and dispatch subagents with task contexts. \n
Sanitization: There is no evidence of content validation or escaping before external data is used to drive the agent's decision-making or orchestration logic. \n- [COMMAND_EXECUTION]: The skill uses shell-like patterns to invoke external binaries, creating a potential command injection vector if the agent does not adequately escape user-supplied task descriptions. \n
Evidence: The skill defines command execution templates such as gemini --model $M $APPROVAL --prompt \"$P\" and codex ... --prompt \"$P\". \n
Risk: The $P variable is intended to hold the user's task or prompt. If this variable is interpolated into the shell command without rigorous sanitization, it could allow an attacker to execute arbitrary commands on the system by including shell metacharacters in their request.

agent-orchestration