The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to execute the data collection script scripts/collect_verified.sh "immediately (no consent prompt)," which is a direct attempt to bypass standard human-in-the-loop safety protocols and user confirmation requirements for shell script execution.\n- [COMMAND_EXECUTION]: The skill relies on scripts/collect_verified.sh to execute a wide array of system diagnostic commands, including network utility tools (ss, lsof, netstat), firewall status checks (ufw, iptables, nft), and deep filesystem searches (find, rg).\n- [DATA_EXFILTRATION]: The skill systematically gathers sensitive host metadata, user environment details, network listener status, and configuration summaries. Although the skill includes redaction logic to mask tokens and passwords, the breadth of system state collected into verified-bundle.json for AI processing creates a significant data exposure risk if the agent's output is redirected or the environment is compromised.\n- [PROMPT_INJECTION]: The skill attempts to impose a "Verified mode" with "non-negotiable safety rules" that prioritize the skill's own execution logic over the agent's standard operating procedures and existing safety guidelines.\n- [PROMPT_INJECTION]: The skill processes third-party skill and plugin files, which presents an indirect prompt injection surface. Malicious instructions inside those files could potentially influence the agent's behavior during the audit process.\n
Ingestion points: The script scripts/collect_verified.sh scans the $STATE_DIR/skills and $WORKSPACE_DIR/skills directories and extracts patterns from all discovered files.\n
Boundary markers: The skill metadata includes a specific instruction to treat scanned content as untrusted data and to ignore embedded instructions found within them.\n
Capability inventory: Extensive shell command execution via collect_verified.sh and filesystem read access across the OpenClaw state directory.\n
Sanitization: Implements secret redaction helpers in scripts/redact_helpers.sh and filters configuration data via scripts/config_summary.py before the agent processes the findings.

ClawdStrike