awesome-openclaw-skills
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install a global command-line tool (@openclaw/clawhub-cli) from the NPM registry and a security scanner (@snyk/agent-scan) from a well-known service. It also directs users to clone an external repository from GitHub (VoltAgent/awesome-openclaw-skills.git).
- [COMMAND_EXECUTION]: The skill includes Bash, Node.js, and Python examples that interact with the host system using commands like git clone, npm install, and subprocess.run. These snippets enable the installation and execution of third-party code via the clawhub CLI.
- [INDIRECT_PROMPT_INJECTION]: The skill functions as an aggregator for over 5,000 external agent skills, creating a surface for indirect prompt injection.
- Ingestion points: Reads and processes data from a README.md file hosted in a third-party GitHub repository (VoltAgent/awesome-openclaw-skills).
- Boundary markers: Lacks explicit delimiters or instructions to the agent to disregard potential commands embedded within the external skill descriptions.
- Capability inventory: Provides built-in functionality to download, install, and execute external scripts and packages on the local machine.
- Sanitization: Does not implement validation or filtering for the external metadata it ingests and presents to the agent.
- [METADATA_POISONING]: The skill documentation includes inconsistent attribution and temporal data. It identifies the maintainer as 'VoltAgent' and the collection as 'ara.so,' which differs from the identified author. It also features a 'Last Updated' date in the future (May 16, 2026), which may be deceptive or indicative of automated template errors.
Audit Metadata