The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit instructions designed to override the agent's behavior and tool usage. Specifically, Pattern 3 provides a text snippet meant to be used in conversation that instructs the agent to disable its built-in web_search and web_fetch tools and replace them with a specific external tool (agent-reach), effectively hijacking the agent's tool-calling logic.
[PRIVILEGE_ESCALATION]: The configuration instructions in Pattern 4 and the Troubleshooting section advocate for mounting the host's Docker socket (/var/run/docker.sock) into the container. This provides the container with full administrative control over the host Docker daemon, which is equivalent to root access on the host system.
[EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an untrusted GitHub account (justlovemaki/openclaw-china-docker) and pull a Docker image from an untrusted registry user (justlikemaki/openclaw-docker-cn-im). These sources are not recognized as trusted organizations or well-known services.
[REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by providing instructions to install plugins at runtime using npx openclaw plugin:install larksuite/openclaw-lark. This fetches and executes code from an external repository during the skill's operation.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface for indirect prompt injection by design.
Ingestion points: The agent processes incoming messages and data from external Chinese IM platforms (Feishu, DingTalk, QQ, WeChat Work).
Boundary markers: None are present in the instructions to help the agent distinguish between user intent and data content from these external channels.
Capability inventory: The skill has the capability to execute code in Docker containers, install new plugins via npx, and manipulate system environment variables.
Sanitization: There is no mention of sanitizing or filtering input received from the external messaging platforms before it is processed by the AI agent.

openclaw-china-docker