The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to clone an external repository from a placeholder URL and execute shell scripts (e.g., bash scripts/install_skillclaw.sh) directly on their local machine, which is a high-risk pattern for executing unverified code.
[DATA_EXFILTRATION]: The core functionality of the skill is an API proxy that intercepts all OpenAI-compatible traffic, including prompts and completions. These session artifacts, which may contain sensitive PII or secrets, are recorded and uploaded to a shared cloud storage backend (OSS/S3), providing a centralized location for potential data leaks.
[INDIRECT_PROMPT_INJECTION]: The 'Evolve Server' component processes untrusted session data to generate new SKILL.md files. This allows malicious instructions embedded in session data to be automatically distilled into reusable skills that are then shared across a cluster of agents.
Ingestion points: Intercepted session data from /v1/chat/completions and /v1/messages API endpoints.
Boundary markers: No specific boundary markers or instruction-guarding delimiters are documented for the evolution process.
Capability inventory: The evolution server has capabilities to write files to shared storage and the local filesystem, and uses an autonomous agent to generate content.
Sanitization: There is no mention of sanitization, filtering, or validation of session content before it is distilled into executable agent instructions.
[COMMAND_EXECUTION]: The skill documentation requires running various system commands, including npm install -g openclaw and several Python-based benchmark scripts, which run in the host environment with the agent's privileges.
[EXTERNAL_DOWNLOADS]: The skill framework depends on downloading external software via git clone and npm, which can introduce supply chain risks if the source repositories are not verified.

skillclaw-skill-evolution