The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements several utility shell scripts in the ./scripts/ directory, such as sitemap.sh, search.sh, and fetch-doc.sh. These scripts are used to navigate and retrieve documentation metadata. In their current form, they are benign stubs that perform simple echo or case-switch operations.
[CREDENTIALS_UNSAFE]: The file snippets/common-configs.md contains configuration templates for third-party services like Discord and Telegram. The skill correctly follows security best practices by using environment variable placeholders (e.g., ${DISCORD_TOKEN}) instead of hardcoding actual secrets.
[PROMPT_INJECTION]: The skill fetches documentation from an external domain (docs.clawd.bot). This creates a surface for indirect prompt injection, as the agent processes content from that external source.
Ingestion points: Documentation content is fetched from https://docs.clawd.bot/ via the fetch-doc.sh script logic.
Boundary markers: The skill does not currently employ specific delimiters or warnings to the agent to ignore instructions embedded within the documentation it retrieves.
Capability inventory: The skill possesses the capability to execute shell scripts and access the local file system for indexing.
Sanitization: No explicit sanitization or filtering of external documentation content is present in the provided scripts.

clawddocs