The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a standard operating procedure for the agent to consume untrusted data from historical session logs and use it to modify its own behavioral instructions and personality files.
Ingestion points: The agent is instructed to read all .jsonl session logs containing user instructions and tool outputs from the ~/.openclaw/agents/${agentId}/sessions directory (SKILL.md, Step 2).
Boundary markers: The instructions do not implement delimiters, escaping, or explicit safety prompts to prevent the agent from obeying or incorporating malicious instructions that may be embedded within the historical logs.
Capability inventory: The skill utilizes read, write, and edit tools to modify core identity and constraint files including USER.md, SOUL.md, AGENTS.md, and MEMORY.md (SKILL.md, Step 5).
Sanitization: There is no requirement for the agent to filter or validate the summarized content before it is physically written into the persistent configuration files, allowing for potential 'self-poisoning'.
[COMMAND_EXECUTION]: The skill requires the agent to perform extensive file system operations, including reading from sensitive paths, creating backups, and performing 'physical' modifications to the agent's core identity files. This operational tier is necessary for the skill's purpose but creates a significant impact surface if the analysis phase is influenced by malicious log content.

agent-retro