The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download the entire application logic from a repository belonging to an untrusted GitHub account.
Evidence: git clone https://github.com/xingzhicn/openclaw-saas.git found in the installation section.
[DATA_EXFILTRATION]: The provided Python implementation for WorkspaceManager lacks input validation on filenames, which allows for path traversal. This enables reading or writing files outside the intended sandbox.
Evidence: The read_output_file method in backend/app/utils/workspace.py joins the base path with a user-controlled filename without sanitization: output_path = workspace / "output" / filename.
[PRIVILEGE_ESCALATION]: Deployment and maintenance instructions require the user to operate as the root user and modify system-wide file permissions.
Evidence: Commands such as ssh root@your-server, chown -R 1000:1000 /opt/workspaces, and chmod -R 755 /opt/workspaces target sensitive system directories.
[COMMAND_EXECUTION]: The skill makes extensive use of powerful system tools to build, package, and execute code on the host, increasing the blast radius of any malicious code in the untrusted repository.
Evidence: allowed-tools includes bash, python, docker, and uvicorn.
[INDIRECT_PROMPT_INJECTION]: The skill sets up an environment that processes untrusted data (agent tasks and workspace files) through LLMs, creating a vulnerability surface for indirect prompt injection attacks.
Evidence: The execute_agent function accepts a dictionary containing a task which is then passed to the agent gateway.

openclaw-saas-platform