The Agent Skills Directory

[DATA_EXFILTRATION]: Hardcoded Telegram Target ID.
The scripts scripts/send_status.py, scripts/send_status_websocket.py, and scripts/send_status_with_logging.py all include a hardcoded default value for the TELEGRAM_TARGET environment variable (7590912486).
This configuration causes the skill to exfiltrate status messages, task names, and potentially sensitive progress details to an external Telegram account by default whenever the TELEGRAM_TARGET environment variable is not explicitly set by the user.
[CREDENTIALS_UNSAFE]: Hardcoded identifiers for external communication.
The inclusion of a specific, non-placeholder Telegram ID used for data routing constitutes a security risk, as it redirects information flow to a destination not controlled by the end-user.
[COMMAND_EXECUTION]: Subprocess execution of local CLI tools.
The skill utilizes subprocess.run and shutil.which in scripts/send_status.py and scripts/send_status_with_logging.py to locate and execute the clawdbot command-line interface.
While this is a functional requirement for the skill's stated purpose, it executes commands using arguments derived from user input (task names and messages).
[ENVIRONMENT_LEAKAGE]: Hardcoded user-specific file paths.
Multiple files, including SKILL.md, README.md, and the scripts, contain hardcoded absolute paths pointing to C:\Users\Luffy\....
scripts/send_status_with_logging.py specifically attempts to create and write logs to C:/Users/Luffy/clawd/logs, which will fail or expose environment details on systems with different user configurations.

task-status