The Agent Skills Directory

[COMMAND_EXECUTION]: Potential shell command injection in SKILL.md. The Worker Agent Workflow defines the USER_PROMPT variable using an unquoted heredoc (<< EOF) that interpolates $RESUME_CONTENT. Because this variable contains raw input from the user, an attacker can include shell command substitution patterns (e.g., $(...) or backticks) that will be executed by the shell during the variable assignment.
[DATA_EXFILTRATION]: Insecure handling of sensitive user data in SKILL.md. The skill writes the raw RESUME_CONTENT to a temporary file in /tmp/openclaw/sn-image-resume/<task_id>/. This location is often world-readable, potentially exposing sensitive Personally Identifiable Information (PII) to other users or processes on the system.
[PROMPT_INJECTION]: Vulnerability to indirect prompt injection in SKILL.md. The skill exhibits the following characteristics:
Ingestion points: Untrusted user input enters the agent context via the resume_content parameter in the Worker Agent Workflow.
Boundary markers: Missing. The skill uses a simple text label (Resume content:) rather than robust delimiters like XML tags or unique boundary strings to isolate user data.
Capability inventory: The skill has the capability to execute shell commands and trigger image generation via the sn_agent_runner.py script.
Sanitization: Absent. There is no evidence of filtering, escaping, or validation of the resume_content before it is interpolated into the prompt for the sn-text-optimize tool.

sn-image-resume