The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with multiple well-known search and data providers, including Exa, Tavily, and the Grok API (xAI), to aggregate results. It also performs direct fetches of web content from domains such as github.com, reddit.com, news.ycombinator.com, and v2ex.com to extract discussion threads and references.- [DATA_EXFILTRATION]: To authenticate API requests, the skill reads local configuration and credential files, specifically ~/.git-credentials for GitHub access and ~/.openclaw/credentials/search.json for search provider keys. These credentials are used solely to facilitate authorized communication with the intended service endpoints.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted external content (web page text, GitHub comments) and interpolates it into LLM prompts within chain_tracker.py and relevance_gate.py. Ingestion points: Content is fetched via fetch_thread.py and processed in chain_tracker.py. Boundary markers: Minimal isolation is used, such as basic quotes during interpolation in relevance_gate.py. Capability inventory: The skill performs network operations and reads local configuration files. Sanitization: No explicit sanitization or escaping of ingested text is performed before it is sent to the LLM.- [COMMAND_EXECUTION]: The search.py script utilizes importlib to dynamically load the fetch_thread.py module from a path relative to its own location within the skill directory for modular execution.

search-layer