The Agent Skills Directory

[COMMAND_EXECUTION]: Found in scripts/adapters/native-browser.js. The functions navigate, snapshot, and callBrowserTool construct shell commands by joining arrays into strings and passing them to execSync. This pattern allows for command injection if input parameters like url, targetId, or refs contain shell metacharacters (e.g., ;, &, |).
Evidence in navigate: execSync(openclaw ${args.join(' ')}, ...) where args includes the url parameter.
Evidence in callBrowserTool: execSync(openclaw ${args.join(' ')}, ...) where args includes the request parameter.
[COMMAND_EXECUTION]: Found in scripts/composite/tweet.js. The uploadMedia function uses execSync to execute the openclaw CLI and interpolates a JSON string containing the mediaPath into a shell command within single quotes. If the mediaPath contains single quotes, an attacker could break out of the shell quoting to execute arbitrary commands.
[EXTERNAL_DOWNLOADS]: The skill requires external binaries openclaw and agent-browser. The installation script install.sh checks for these tools and provides guidance on how to install them from their official sources.
[PROMPT_INJECTION]: The skill exhibits a vulnerability to indirect prompt injection by acting on untrusted data from web pages.
Ingestion points: nativeBrowser.snapshot() in scripts/composite/tweet.js and index.js.
Boundary markers: None; the skill uses webpage attributes like aria-label, data-testid, and role directly for logic.
Capability inventory: Subprocess execution via execSync and spawn for browser interactions (click, type, navigate).
Sanitization: No sanitization is performed on data retrieved from the DOM before it is used in automation logic.

browser-plus