The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/install-openclaw-plugin.sh contains a command (curl -fsSL https://get.openclaw.dev | bash) that downloads a script from an external, non-whitelisted domain and executes it directly in the shell. This is a primary vector for arbitrary remote code execution.
[COMMAND_EXECUTION]: In hermes-plugin/memory/memory_tencentdb/supervisor.py, the subprocess.Popen function is used to spawn a Gateway process using a command string (self._gateway_cmd) derived from the MEMORY_TENCENTDB_GATEWAY_CMD environment variable. This allows the execution of arbitrary local commands if an attacker can influence the environment configuration.
[DATA_EXFILTRATION]: The SKILL-DIAGNOSTIC-EXPORT.md instruction file describes a workflow to package the entire memory-tdai/ directory—which contains raw user conversation history (L0 records)—into a compressed archive. While the intended use is for user-initiated diagnostics, the skill effectively creates a mechanism to aggregate and transport highly sensitive PII (Private Identifiable Information) and chat logs into a single file.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant vulnerability surface for indirect prompt injection:
Ingestion points: Raw conversation messages (L0 records) are ingested from untrusted user input and processed for memory extraction in src/core/record/l1-extractor.ts.
Boundary markers: The prompts used for extraction in src/core/prompts/l1-extraction.ts lack explicit delimiters or instructions to ignore embedded commands within the conversation text.
Capability inventory: The skill possesses dangerous capabilities including subprocess spawning in hermes-plugin/memory/memory_tencentdb/supervisor.py and arbitrary file writing in src/core/persona/persona-generator.ts.
Sanitization: While src/core/conversation/l0-recorder.ts includes a sanitizeText function, it primarily targets known tag patterns rather than preventing adversarial instruction following.

openclaw-memory-tencentdb-setup