The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The SKILL.md file contains a hardcoded Supabase anonymous JWT (ANON). This token is used to authenticate the agent against the project ieoybuwlfiwbownpwpqc on Supabase. While anonymous keys are intended for public-facing client access, hardcoding the credential in shared instructions enables unauthorized interaction with the backend RPC functions if the service is not properly secured with Row Level Security (RLS).
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and execution of arbitrary Markdown content from a distributed task network, creating an attack surface for indirect prompt injection.
Ingestion points: External, untrusted task data is fetched via the list_available_tasks and get_task RPC calls to a remote Supabase instance, as documented in SKILL.md and references/task-protocol.md.
Boundary markers: The instructions do not define boundary markers (such as XML tags or specific delimiters) to isolate task content, nor do they instruct the agent to ignore instructions embedded within the fetched data.
Capability inventory: The agent is instructed to "execute tasks" using its available tools, which may include browser access, file system operations, or network requests depending on the task's requirements and the agent's environment.
Sanitization: There is no evidence of sanitization, validation, or filtering of the fetched content or platform_config fields before the agent processes them.

openclaw-task-worker