The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands via pnpm, crabbox, and blacksmith to orchestrate remote validation tasks and manage local environment state.
[REMOTE_CODE_EXECUTION]: The skill employs crabbox run with --shell and --script flags to execute arbitrary code on remote AWS instances, Blacksmith Testbox containers, and static SSH targets.
[PRIVILEGE_ESCALATION]: The instructions include the use of sudo to modify system directories, such as creating symbolic links in /usr/local/bin, which requires elevated permissions.
[CREDENTIALS_UNSAFE]: The skill provides guidance on handling sensitive authentication tokens (CRABBOX_COORDINATOR_TOKEN) and API keys (OPENAI_API_KEY) using environment variable forwarding and command-line inputs.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from remote sources, which could potentially contain malicious instructions.
Ingestion points: Remote execution logs and test artifacts (e.g., Playwright reports, JUnit XML) captured via flags like --capture-stdout and --capture-on-fail.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore content within these external files.
Capability inventory: The skill has broad capabilities including arbitrary shell execution and file system access across all supported providers.
Sanitization: The skill does not mention any sanitization or validation of the remote content before it is processed.
[EXTERNAL_DOWNLOADS]: The skill references downloading and installing the crabbox tool from the vendor's repository and authenticating with the vendor's coordinator service at https://crabbox.openclaw.ai.

crabbox