The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation instructions require cloning a repository from a personal GitHub account (MuhammadHasbiAshshiddieqy/OpenClawn.git) and installing its dependencies via uv or pip.
[DYNAMIC_EXECUTION]: The framework includes explicit tools (code_run and shell_run) designed to execute arbitrary Python code and shell commands. While the documentation states these are sandboxed using Docker with no network access, the ability to generate and execute code at runtime is an inherent risk of the framework's 'skill crystallization' and 'self-improving' capabilities.
[COMMAND_EXECUTION]: The skill provides the agent with the ability to execute shell commands (e.g., ls -lah /workspace) and Git operations, which could be misused if the agent is influenced by malicious input.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: The agent can fetch web pages, perform web searches, and read PDF or SQLite files (SKILL.md).
Boundary markers: The documentation mentions 'SSRF + injection guards' and 'NFKD normalization' specifically for skill pack imports, but does not detail similar protections for general web content or file parsing.
Capability inventory: The framework possesses powerful capabilities including arbitrary code execution, shell command execution, and file writing across the workspace (SKILL.md).
Sanitization: Security measures are described, such as Docker sandboxing with network=none and SSRF protections that block private IPs and cloud metadata endpoints, which serve as mitigations.

openclawn-agent-framework