The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation specifies that session cookies for multiple platforms (Xiaohongshu, Douyin, Bilibili, TikTok, X, WeChat, Boss Zhipin, Binance) are stored in a predictable local directory (~/.clawfirm/sessions/).
[DATA_EXFILTRATION]: The skill provides tools to extract sensitive recruitment data from Boss Zhipin (zhipin.yaml), including candidate names,应聘职位 (applied positions), and full chat histories/latest messages.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its architecture of reading untrusted data and possessing write capabilities:
Ingestion points: Data is ingested via search (all platforms), hot (TikTok/XHS), chat_stats (Boss Zhipin), and candidates (Boss Zhipin) commands found in SKILL.md.
Boundary markers: The instructions do not define boundary markers or 'ignore' directives for the agent when processing content from these web sources.
Capability inventory: The skill has extensive write capabilities including post, post_video, comment, reply, and follow across all major platforms, as well as download functions to save files locally.
Sanitization: There is no mention of sanitization or validation of the text/data retrieved from social media platforms before it is processed by the agent.

social-cli