The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill stores sensitive credentials, including cleartext usernames and passwords, in the ~/.openclaw/auth-platforms.json file. This is a high-risk practice as any process with read access to the user's home directory can harvest these credentials.
[DATA_EXFILTRATION]: The skill manages and stores full Chrome user data profiles (cookies, localStorage, IndexedDB) in ~/.openclaw/chrome-profiles/. While necessary for session management, these files are highly sensitive and can be used for session hijacking if accessed by unauthorized actors.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to manage browser instances, including fast-browser-use, pkill, and timeout. It also manipulates the system's PATH and DISPLAY environment variables.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external websites via the fast-browser-use snapshot command and processes the resulting DOM content using grep and keyword matching.
Ingestion points: Website content is retrieved via fast-browser-use snapshot from arbitrary URLs defined in the platform configuration.
Boundary markers: No boundary markers or sanitization logic are defined for the scraped web content.
Capability inventory: The skill can execute shell commands (fast-browser-use, pkill), write to the file system (mkdir, jq redirects), and interact with active processes via process.write.
Sanitization: There is no evidence of sanitization or escaping applied to the scraped DOM content before it is processed by the agent.

auth-manager