OpenClaw Task Experience Summaries

Experience summaries for OpenClaw tasks, including common installation problems, troubleshooting steps, and best practices for packages, configurations, and...

This skill is a documentation/troubleshooting guide and appears internally consistent. It won't install or run code by itself, but it recommends commands (e.g., npm install -g clawhub) and mentions API keys. Before following any commands: verify the package and registry (don't install unknown global npm packages as root), confirm the provenance of tools like 'clawhub' and 'tavily' (check official sites or GitHub repos), and never paste secret keys into untrusted pages or tools. Note that the skill's source/homepage is missing — if you want stronger assurance, ask the publisher for a repository or official homepage to verify origins before using their recommended binaries or registries.

Type: OpenClaw Skill Name: task-experience-summaries Version: 1.0.0 The skill's primary purpose is benign, providing troubleshooting and documentation for OpenClaw tasks. However, the `SKILL.md` contains instructions for the AI agent to 'Update relevant section in this SKILL.md' with new experiences. This creates a significant prompt injection vulnerability, as an attacker could potentially trick the agent into injecting malicious markdown or commands into its own skill definition, altering its future behavior. While the intent is for documentation, the mechanism allows for self-modification of the skill's instructions based on agent input, which is a high-risk capability. Additionally, the use of `npm i -g clawhub --force` in troubleshooting, while common, bypasses checks and could be misused if the agent is later tricked into installing a malicious package with the `--force` flag.