The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file diagnostics.md contains a hardcoded API key (phc_fx1Hhx9ucz8GuaJC8LVZWO8u03yXZZJJ6ObS4yplnaP). While this appears to be a public PostHog key, the presence of hardcoded credentials in skill instructions is a security risk.\n- [DATA_EXFILTRATION]: The skill collects environment and usage metadata and exfiltrates it to a third-party service (us.i.posthog.com) using curl. While the skill requests user permission and claims to exclude PII, it transmits data to a non-whitelisted external domain.\n- [REMOTE_CODE_EXECUTION]: The skill features a self-refresh mechanism in Phase 0 that fetches updated instructions from a remote repository (github.com/nanocoai/nanoclaw.git) and instructs the agent to follow the new version immediately. This allows for remote modification of the agent's behavior.\n- [DYNAMIC_EXECUTION]: The skill includes instructions to programmatically modify its own source files (SKILL.md and diagnostics.md) to implement a telemetry opt-out. Self-modifying instruction sets can be abused to maintain persistence or alter agent constraints.\n- [INDIRECT_PROMPT_INJECTION]: In Phase 1.4, the skill spawns sub-agents to analyze and summarize diffs and file contents from the repository. This represents a significant attack surface where malicious instructions embedded in the codebase could influence the sub-agents and subsequently the main agent's execution flow.\n- [COMMAND_EXECUTION]: The skill executes high-privilege system and development commands including launchctl, systemctl, pnpm install, git worktree, and git reset --hard. It also symlinks sensitive files like .env into temporary worktrees during testing.\n- [EXTERNAL_DOWNLOADS]: The skill fetches code and configuration from the author's GitHub repository (github.com/nanocoai/nanoclaw.git).

migrate-nanoclaw