Source Library

Searchable knowledge base that captures and cross-references everything users share. Auto-triggers when user shares ANY URL (article, tweet, thread, repo, vi...

This skill appears to do what it says: create and manage a local markdown knowledge base. Before installing or enabling auto-triggering, consider the following: - Privacy: the skill auto-processes and saves any URL shared in chat. If you (or other users) sometimes post private links, one-off auth-bearing URLs, or internal resources, those could be written to disk. Avoid sharing sensitive links while it's enabled or disable the auto-trigger. - Workspace location: set OPENCLAW_WORKSPACE to a directory you control (or run setup in a sandbox workspace) so saved files go where you expect (life/source/*). Review permissions on that directory. - Inspect remainder of code: the provided source shows only filesystem operations; however a truncated portion remains. Review the full scripts/source-library.js to confirm there are no network fetches or remote endpoints used when auto-processing. - Run tests in a sandbox: run scripts/test.js with OPENCLAW_WORKSPACE pointed to a disposable temp directory to see behavior and outputs before using with real data. - Canonicalization limits: the code strips some tracking params (utm_*, fbclid, gclid, etc.) but will not remove secrets embedded in URL paths or uncommon query param names. Be careful with token-bearing URLs. - Control auto-processing: if you want the library but not automatic captures, install the skill but do not enable the agent-side auto-trigger, or use the CLI manually to save only links you want persisted. If you want me to, I can (a) scan the remaining truncated portion of scripts/source-library.js for network activity and hidden behavior, (b) produce a checklist of file-system paths and example commands to sandbox the skill safely, or (c) highlight exact lines to change to disable automatic saving.

Type: OpenClaw Skill Name: source-library Version: 2.1.1 The skill is vulnerable to shell injection due to the `SKILL.md`'s auto-trigger behavior combined with `allowed-tools: "Bash(node:*)"`. The agent is instructed to execute `node scripts/source-library.js save` with arguments derived from user-shared URLs (e.g., `--name`, `--url`, `--claims`). If these user-controlled values are not properly sanitized by the agent before constructing the Bash command, a malicious user could inject arbitrary shell commands. Additionally, the agent is instructed to 'Analyze with context' using content from user-populated markdown files, creating a potential prompt injection vector against the agent itself.