The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted data from GitHub. \n
Ingestion points: Phase 2 (GitHub issues) and Phase 6 (PR review comments and body content). \n
Boundary markers: External content such as issue bodies and comments is interpolated into sub-agent prompts without delimiters or instructions to ignore embedded commands. \n
Capability inventory: Spawned sub-agents possess significant capabilities, including repository modification via git, network communication via curl, and the ability to execute code via test runners. \n
Sanitization: No validation or sanitization of external GitHub content is performed before processing. \n- [REMOTE_CODE_EXECUTION]: The skill orchestrates sub-agents that generate and execute code based on untrusted inputs. Evidence: Phase 5 and Phase 6 involve agents implementing code fixes and running test suites on modified codebases. \n- [CREDENTIALS_UNSAFE]: The skill accesses local files to retrieve sensitive authentication tokens. Evidence: Phase 2 and sub-agent prompts read from ~/.openclaw/openclaw.json and /data/.clawdbot/openclaw.json to extract the GH_TOKEN. \n- [COMMAND_EXECUTION]: Utilizes system utilities including curl for API interaction, git for repository management, and node -e for configuration parsing. \n- [EXTERNAL_DOWNLOADS]: Interacts with the GitHub REST API (api.github.com), which is a well-known service expected for the skill's primary functionality.

gh-issues