The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill reads the sensitive system file ~/.openclaw/openclaw.json to retrieve the gateway authentication token (lib/gateway.js).\n- [CREDENTIALS_UNSAFE]: The framework clones the authProfiles property from existing agents to the soulflow-worker agent, exposing third-party service credentials (such as GitHub or cloud provider tokens) to automated processes (lib/runner.js).\n- [COMMAND_EXECUTION]: The skill programmatically grants the full tool profile to the worker agent, enabling unrestricted execution of shell commands and file system modifications via the exec and edit tools (lib/runner.js).\n- [COMMAND_EXECUTION]: The lib/nl-handler.js script spawns Node.js subprocesses using user-provided task descriptions as command-line arguments. While using array-based arguments, the lack of input validation on the task string poses a risk if passed to downstream shell-based tools.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by design. Workflow steps interpolate the raw output of previous steps (e.g., results from web_fetch or read tools) into the prompt for the next step using the {{stepid_output}} variable. The absence of boundary markers or sanitization allows malicious data found in external files or websites to be interpreted as agent instructions, potentially leading to unauthorized operations using the worker's elevated permissions.

soulflow