The Agent Skills Directory

[COMMAND_EXECUTION]: The setup process modifies environment configurations to explicitly bypass security protections. It sets bypassPermissions in the Claude Code settings.json file and configures Codex with sandbox_mode = "danger-full-access", granting AI agents unrestricted shell access without user confirmation.
[COMMAND_EXECUTION]: Internal helper functions execGitWithAuth in src/lib/pro-installer.ts and src/lib/openclaw-installer.ts construct shell commands using string interpolation of tokens and repository URLs. This pattern is vulnerable to command injection if the inputs contain shell metacharacters.
[EXTERNAL_DOWNLOADS]: The tool fetches and executes remote installation scripts from the web during setup, specifically for the Bun runtime (https://bun.sh/install) and the Oh My Zsh framework (https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh).
[DATA_EXFILTRATION]: The CLI includes a telemetry module (src/lib/telemetry.ts) that transmits system environment data to https://codelynx.dev/api/cli/events. The data collected includes OS type/version, total memory, CPU count, shell type, the user's home directory path, and the specific filesystem path to the user's Pro access token.
[PROMPT_INJECTION]: The fix-on-my-computer skill contains recursive instructions (e.g., "NEVER give up until every single test is green", "REPEAT until 100% green") that override standard agent behavior. This could lead to resource-intensive infinite loops or unintended system modifications if the agent encounters persistent environment issues.
[COMMAND_EXECUTION]: Multiple skill files, such as agents-config/skills/merge/SKILL.md, utilize dynamic context injection (!command syntax) to execute shell commands like git branch and git status automatically when the skill is loaded by the agent.

cli