The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the download and immediate execution of remote shell scripts from an untrusted source, enabling full system compromise.
Evidence: curl -fsSL https://raw.githubusercontent.com/miaoxworld/OpenClawInstaller/main/install.sh | bash in SKILL.md.
Evidence: curl -fsSL https://raw.githubusercontent.com/miaoxworld/OpenClawInstaller/main/config-menu.sh | bash in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill relies on unverified third-party repositories for its core installation and management tools.
Evidence: Links to github.com/miaoxworld/OpenClawInstaller.git and github.com/miaoxworld/openclaw-manager in SKILL.md.
[COMMAND_EXECUTION]: The skill encourages the execution of local shell scripts and global package installations without adequate security review.
Evidence: Use of chmod +x install.sh followed by ./install.sh.
Evidence: Instructions for npm install -g openclaw.
[INDIRECT_PROMPT_INJECTION]: The skill implements a feature to process custom "skills" from Markdown files, which lacks boundary markers or sanitization, creating a vulnerability to malicious data.
Ingestion points: The agent is instructed to read and execute logic from Markdown files placed in the ~/.openclaw/skills/ directory.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when the agent processes these files.
Capability inventory: The skill has access to network operations (curl), system commands (openclaw CLI), and file writing capabilities.
Sanitization: There is no evidence of validation or filtering for the content provided in the external skill files.

openclaw-deployment-installer