The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The CLI tool tool_exec.py contains a --get-authorization flag that retrieves and displays OAuth access_token and refresh_token values in plain text. Although the skill documentation advises against its use in the agent flow, the presence of this capability allows a malicious or tricked agent to expose session credentials in its output.
[DATA_EXFILTRATION]: The skill implements a --proxy-request function that permits the agent to make arbitrary HTTP requests (including POST, PUT, and DELETE) to any path on a connected account. This provides a mechanism for data to be sent to external endpoints beyond the predefined tool catalog.
[DATA_EXFILTRATION]: The skill is susceptible to indirect prompt injection due to its core function of ingesting data from external SaaS platforms.
Ingestion points: Results from third-party tools and API responses from the proxy are returned directly to the agent context via tool_exec.py.
Boundary markers: No delimiters or protective instructions are used to wrap the untrusted external data before it enters the agent's processing stream.
Capability inventory: The skill has extensive permissions to read and write data across 50+ service providers, perform arbitrary network requests, and save binary data to the local file system using the --output-file argument.
Sanitization: External API responses are printed to standard output for the agent without validation or sanitization, allowing potential malicious instructions embedded in third-party data to influence the agent's behavior.

openclaw-tool-executor