The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the openclaw security audit --deep command to analyze local environment configurations and permission states. It includes pre-flight safety checks using which openclaw to verify the binary origin and issues warnings if a production gateway is detected.
[EXTERNAL_DOWNLOADS]: The skill performs HTTPS GET requests to fetch JSON metadata from matrix.tencent.com regarding skill reputation and CVE advisories. These calls are limited to non-sensitive identifiers (skill name, product version) and can be fully disabled by the user via environment variables (AIG_CLOUD_LOOKUP=off).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by auditing the metadata and code of other installed skills. While this creates an ingestion surface, the skill implements defensive logic specifically designed to detect and flag prompt injection attempts, such as jailbreaks or obfuscated instructions, within the analyzed content.

edgeone-clawscan