The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions require cloning a repository from an untrusted source (github.com/cft0808/edict.git) and executing an included shell script (install.sh), which runs with the user's local permissions.
[EXTERNAL_DOWNLOADS]: The skill recommends pulling and running a Docker container (cft0808/sansheng-demo) from an untrusted registry user, bypassing local security controls.
[INDIRECT_PROMPT_INJECTION]: The system's multi-agent architecture creates a significant attack surface for indirect prompt injection. User messages ("edicts") are passed through a chain of twelve specialized agents.
Ingestion points: User messages are ingested via the taizi agent through the openclaw send command.
Boundary markers: The skill relies on SOUL.md markdown files for agent instructions but lacks explicit delimiters or specific warnings to ignore instructions embedded in user-supplied data.
Capability inventory: The system's scripts and agents have access to local file systems, network communication via urllib.request, and command execution via subprocess.run.
Sanitization: While the state machine validates task transitions, it does not provide content validation or sanitization for the instructions being passed between agents.
[COMMAND_EXECUTION]: The provided Python utilities use subprocess.run to interact with the openclaw CLI, which executes commands that include unvalidated user-supplied message strings.
[DATA_EXFILTRATION]: The system includes a mechanism to send data summaries to the Feishu communication platform using its public API (open.feishu.cn).

edict-multi-agent-orchestration