The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation promotes a high-risk installation method using curl -fsSL https://openclaw.ai/install.sh | bash, which executes unverified code from a remote server directly in the system shell.
[COMMAND_EXECUTION]: The skill provides instructions for using the exec tool, which can run arbitrary shell commands on the host system or in a sandbox. Without strict sandboxing, this provides a direct path for system compromise.
[DATA_EXFILTRATION]: The skill documentation references sensitive files such as ~/.openclaw/openclaw.json, ~/.openclaw/.env, and creds.json which store API keys and platform credentials. These files are accessible through tools like memory_get and exec described in the documentation.
[PROMPT_INJECTION]: The skill defines a large attack surface for indirect prompt injection as the agent is designed to ingest and process data from 22+ messaging platforms, PDF documents, and external URLs.
Ingestion points: Messaging channel inputs, PDF analysis, and web_fetch tool outputs.
Boundary markers: No specific delimiters or safety warnings for data interpolation are described in the instructions.
Capability inventory: High-privilege tools including exec, browser automation, and nodes hardware control.
Sanitization: The documentation mentions sandboxing and tool profiles, but these are configuration-dependent and not enforced by the skill itself.

openclaw-genie