The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructs the agent to access and analyze sensitive application data, specifically SQLite databases containing chat sessions, transcripts, and media attachments.
Evidence found in references/upstream/SKILL.source.md regarding paths: ~/.openclaw/agents/<agentId>/agent/openclaw-agent.sqlite and /home/openclaw/.openclaw/.
[COMMAND_EXECUTION]: The instructions include broad filesystem search commands to locate database files if they are not in the expected directory.
Evidence in references/upstream/SKILL.source.md: find / -maxdepth 6 -name openclaw-agent.sqlite.
[DATA_EXFILTRATION]: The skill suggests moving extracted session data or media files from remote hosts to a local machine for analysis.
Evidence in references/upstream/SKILL.source.md: scp files locally (one remote path per scp argument); read there.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from chat transcripts and media attachments, which creates a surface for indirect prompt injection.
Ingestion points: Reads openclaw-agent.sqlite databases, transcript_events, and files from media://inbound/ (Evidence in references/upstream/SKILL.source.md).
Boundary markers: The skill explicitly mentions checking senderId and senderIsOwner in metadata to distinguish between user-provided text and system prompts (Evidence in references/upstream/SKILL.source.md).
Capability inventory: File reading via node:sqlite or sqlite3, filesystem searching via find, and potential network movement via scp (Evidence in references/upstream/SKILL.source.md).
Sanitization: Recommends using full-redacted payload logging to protect private messages (Evidence in references/upstream/SKILL.source.md).

openclaw-debugging