The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone code from a repository owned by an unverified GitHub user (superxs777), which is outside the trust scope of the skill author (modbender).
[REMOTE_CODE_EXECUTION]: The skill executes remote code by downloading the repository and running pip install -r requirements.txt followed by several Python scripts. This creates a supply chain risk where malicious code in the repository could be executed on the user's system.
[COMMAND_EXECUTION]: The skill utilizes system.run to perform shell operations, including database initialization and script execution. While the instructions include defensive rules to limit these commands to a specific list, the capability remains broad.
[DATA_EXFILTRATION]: The skill manages highly sensitive credentials for messaging platforms (Feishu, DingTalk, Telegram) and interacts with an external API (api.pearktrue.cn). This creates a path where credentials or system data could potentially be sent to unauthorized endpoints.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface.
Ingestion points: Fetches news content and hot topics from api.pearktrue.cn (scripts: get_hot_now.py, fetch_hot_items.py).
Boundary markers: No explicit instruction delimiters or markers are defined to prevent the agent from following instructions embedded in the news data.
Capability inventory: The agent has the ability to execute shell commands via system.run and manage scheduled tasks via openclaw cron.
Sanitization: There is no evidence of sanitization or filtering of the external news content before it is processed by the agent.

fastfish-hot