The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from system logs and network status tools.
Ingestion points: System logs (openclaw logs --follow --json) and network status (tailscale status --json) are read into the agent's context as specified in references/upstream/SKILL.source.md.
Boundary markers: The instructions include boundary checks, such as requiring the agent to "match available request, device/public-key, client, mode/role, platform, address, user, and retry-time facts" before taking action.
Capability inventory: The skill utilizes openclaw devices approve <requestId> to modify the system state in references/upstream/SKILL.source.md.
Sanitization: The skill emphasizes manual verification of request IDs and explicitly warns that --latest should only be used as a preview, not for approval.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various local CLI commands to diagnose and repair connections.
Evidence: Commands such as openclaw gateway status, tailscale status, and openclaw devices approve are used throughout references/upstream/SKILL.source.md.
[DATA_EXFILTRATION]: The skill processes sensitive setup codes and authentication tokens that could be exfiltrated if instructions are bypassed.
Evidence: The instructions in SKILL.md and references/upstream/SKILL.source.md explicitly warn against relaying password-equivalent setup codes, signed handoff URLs, or permanent credentials through chat or tool outputs, acknowledging this as a potential risk surface.

openclaw-node-connect