The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly directs the agent to sensitive file paths containing authentication secrets and session data. These include WhatsApp session keys (~~/.openclaw/credentials/whatsapp/default/), Telegram bot tokens (~~/.openclaw/credentials/telegram/*/token.txt), X/Twitter auth cookies (~~/.openclaw/credentials/bird/cookies.json), and Anthropic API tokens (~~/.openclaw/agents/main/agent/auth-profiles.json).
[EXTERNAL_DOWNLOADS]: The instructions facilitate the installation of external code from unverified sources through commands like 'npx add-skill ' and 'clawdhub install ', which bypass standard package registry safety checks.
[COMMAND_EXECUTION]: The skill provides a large library of Bash commands for the agent to execute, including complex piping of cat, jq, grep, and sqlite3. These commands are used to read and modify the bot's core configuration and internal databases.
[REMOTE_CODE_EXECUTION]: The Multi-Agent Orchestration feature uses shell execution to launch background agents with arbitrary command strings. For example, 'bash pty:true background:true command:"codex exec --full-auto '...'"' creates a direct path for executing remote instructions without user intervention.
[DYNAMIC_EXECUTION]: The skill utilizes Python scripts defined within the markdown to process log files and JSON data at runtime (e.g., 'python3 -c "..."'), and it supports dynamic spawning of multiple AI agents as background workers.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external sources, creating an attack surface for indirect injection.
Ingestion points: Runtime logs (~/.openclaw/logs/gateway.log), session transcripts (*.jsonl), and workspace files like SOUL.md and memory logs which can contain content from external chat users.
Boundary markers: The skill does not define or use explicit delimiters or "ignore" instructions when processing these files.
Capability inventory: The skill has extensive capabilities including file system read/write access, SQLite database manipulation, and shell command execution via bash.
Sanitization: There is no evidence of sanitization or validation of the content read from session logs or workspace files before it is processed by the agent or used in subsequent commands.

openclaw-config