The Agent Skills Directory

PROMPT_INJECTION (HIGH): The skill creates a significant surface for Indirect Prompt Injection by bridging external tool servers to the agent's core reasoning loop.\n
Ingestion points: Untrusted data enters the skill via mcpManager.connectServer (fetching tool schemas) and mcpManager.callTool (fetching execution results) in src/index.js.\n
Boundary markers: The skill fails to use delimiters or 'ignore' instructions when returning tool outputs. The result is stringified and returned as raw text in the tool content in src/index.js.\n
Capability inventory: The skill enables the agent to invoke arbitrary capabilities on configured servers, which frequently include file system modifications or shell command execution.\n
Sanitization: No validation or sanitization of the JSON-RPC content from remote servers is performed before presentation to the agent.\n- COMMAND_EXECUTION (MEDIUM): While the current implementation uses HTTP transport, the configSchema in config/openclaw.plugin.json explicitly supports stdio transport with command and args fields. This indicates the skill's capability to spawn and interact with arbitrary local processes based on user configuration.\n- EXTERNAL_DOWNLOADS (LOW): The skill is designed to connect to and download data from remote endpoints configured by the user. While this is the intended function of an MCP client, it creates a dependency on external infrastructure that can influence the agent's safety profile.

mcp-integration