The Agent Skills Directory

[COMMAND_EXECUTION]: The script youtube-tracker-rss.js is vulnerable to shell command injection through the httpGetSync and httpGetAsync functions.
These functions construct a shell command for curl by directly interpolating a URL string: const cmd = \curl -sS -m ${Math.ceil(timeoutMs / 1000)} -x "${PROXY}" -L "${url}"`;`.
In the resolveHandleToChannelId function, the url is built using a user-provided channel handle: const channelUrl = \https://www.youtube.com/@${handleClean}\`;`.
An attacker can provide a handle containing shell metacharacters (e.g., @"; <malicious_command> #) to break out of the quoted URL and execute arbitrary shell commands when the script attempts to resolve the handle.
[CREDENTIALS_UNSAFE]: The youtube-tracker-rss.js script accesses sensitive Telegram bot credentials by reading from the user's home directory.
The function loadBotToken reads the file ~/.openclaw/openclaw.json and extracts the botToken field.
Reading generic configuration files from the home directory for credentials increases the risk of credential exposure if the skill or the environment is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests and displays unsanitized content from external sources.
Ingestion points: The skill fetches data from YouTube RSS feeds (youtube-tracker-rss.js) and the YouTube API (youtube-tracker.js).
Boundary markers: The skill does not use any delimiters or warnings to instruct the agent to ignore instructions that might be embedded in video titles or descriptions.
Capability inventory: The skill has the ability to write to the file system (state/seen.json) and execute network requests via curl.
Sanitization: External data like video titles and channel names are interpolated directly into agent-facing strings without escaping or validation.

wlzh-youtube-tracker