The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses highly sensitive core workspace files, including SOUL.md, MEMORY.md, and IDENTITY.md, which store the agent's primary directives, persona, and continuous history. These files are bundled and transmitted via HTTP POST requests to an external, non-whitelisted domain (soul-upload.com). This domain does not correspond to any authorized infrastructure patterns associated with the author theagentservice, posing a critical data harvesting and exposure hazard.
[COMMAND_EXECUTION]: The script scripts/backup.py leverages Python's subprocess module to run system utilities (tar and openssl). While it passes arguments as list structures to mitigate shell injection hazards, it handles system execution driven by variable file lists and parameters.
[INDIRECT_PROMPT_INJECTION]: The backup recovery process presents a clear indirect prompt injection vulnerability surface:
Ingestion points: In SKILL.md (Workflow 2, Step 5), the agent downloads an archive from the remote server, decrypts/unpacks it, and uses the Read tool to inspect and preview the content of the files.
Boundary markers: Absent. There are no delimiters or specific system instructions telling the agent to ignore hidden natural language payloads inside the recovered files.
Capability inventory: The skill possesses extensive capabilities, including unrestricted file reading, writing, network interactions, and the ability to trigger local shell binaries via subprocesses.
Sanitization: Absent. The files inside the downloaded package are processed and read directly into context without filtering, verification, or validation.

openclaw-backup