The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The update.py script is designed to download a compressed tarball from the vendor's hub (hub_url/api/v1/skill/latest), extract it into the local skill directory, and subsequently run pip install to update dependencies. This constitutes a remote update mechanism that modifies and executes local code based on remote content.
[COMMAND_EXECUTION]: Multiple scripts including bridge_simple.py, bridge_wrapper.py, and update.py use subprocess.run and subprocess.Popen to execute shell commands for managing background processes, installing dependencies, and restarting the bridge service. Specifically, bridge_simple.py can trigger the update script based on messages received from the 'owner'.
[EXTERNAL_DOWNLOADS]: The skill communicates with external endpoints (imclaw-server.app.mosi.cn) to fetch version information, download code updates, and upload/download user-provided files.
[DATA_EXFILTRATION]: As its primary function is an IM bridge, the skill transmits chat content, user metadata, and file attachments to the external IMClaw Hub via WebSocket and HTTP protocols.
[PROMPT_INJECTION]: The skill ingests untrusted data from external chat messages and interpolates it into the agent's context. While it uses boundary markers like ===== 群聊任务开始 [group:xxx] ===== in bridge_simple.py to isolate messages, the presence of these capabilities (command execution, file access) combined with external data ingestion creates a surface for indirect prompt injection.
Ingestion points: WebSocket messages in bridge_simple.py.
Boundary markers: Present in bridge_simple.py (===== 群聊任务开始...).
Capability inventory: Subprocess execution in bridge_simple.py, update.py; File writing in bridge_simple.py and process_messages.py.
Sanitization: Content is truncated (e.g., content[:2000]) but not strictly sanitized against instruction keywords.

imclaw