Exploit for agent-skill-poc

Name: Exploit for agent-skill-poc
Rating: 5 (200 reviews)
2026-03-20 | CVSS 6.1
## https://sploitus.com/exploit?id=682A33CB-562C-54B2-A504-79E1605365A9
# Agent Skill POC - LLM-driven Interactive CLI Agent

An LLM-driven interactive CLI Agent with sandbox execution, human-in-the-loop permissions, and skill integration.

## Features

### Core Architecture

1. **Subprocess Sandbox (Stream Hijacking)**
   - Uses Node.js `child_process.spawn` for subprocess management
   - stdio: `["pipe", "pipe", "pipe"]` to hijack all streams
   - `shell: false` for secure structured argument passing
   - Non-blocking stdout/stderr reading with output truncation (1MB limit)

2. **Human-in-the-Loop Permission Gateway**
   - Command classification strategy:
     - **READ_ONLY**: `ls`, `cat`, `grep`, `find`, `head`, `tail`, `pwd`, `echo`, `python3`, `node` (auto-approved)
     - **DANGEROUS**: `rm`, `mv`, `cp`, `git`, `npm`, `yarn`, `pip`, `wget`, `curl`, `ssh`, `chmod` (requires confirmation)
     - **FORBIDDEN**: `mkfs`, `dd`, `fdisk`, `reboot`, `shutdown`, `curl | bash` patterns (completely blocked)
   - High-risk command approval with impact display

3. **Session State Management (CWD)**
   - Maintains `current_working_directory` variable
   - Parses `cd` command to dynamically update CWD
   - Each subprocess explicitly injected with CWD

4. **Interactive Command Support**
   - Uses `node-pty` for interactive programs (Python REPL, vim, etc.)
   - Stream forwarding: user input → PTY → subprocess → PTY → main process → output

5. **LLM Agent Integration**
   - OpenAI-compatible API support
   - Tool Calling architecture with tools:
     - `run_command`: Execute shell commands (via permission gateway)
     - `run_python`: Execute Python code (temp file + sandbox execution)
     - `call_skill`: Invoke installed skills
     - `list_skills`: List available skills
     - `load_skill`: Install skills from GitHub (Anthropic format)
     - `use_template`: Use templates from skills

6. **Anthropic Skills Compatibility**
   - Full support for [Anthropic's official Skills format](https://github.com/anthropics/skills)
   - Install skills directly from GitHub repositories
   - Template support for skill output formatting
   - Unified registry for both Anthropic and OpenClaw format skills

## Installation

```bash
npm install
npm run build
```

Or install globally:

```bash
npm link
```

## Usage

### Interactive Chat Mode

```bash
# Start interactive chat
npm run chat
# or
node bin/agent-skill-poc.js chat

# With verbose output
node bin/agent-skill-poc.js chat -v

# With custom working directory
node bin/agent-skill-poc.js chat -C /path/to/project
```

### CLI Commands

```bash
# List available skills
agent-skill-poc list
agent-skill-poc list --verbose
agent-skill-poc ls -v

# Run a skill
agent-skill-poc run 
agent-skill-poc run  --dry-run

# Show skill info
agent-skill-poc info 

# Show configuration
agent-skill-poc config
```

### Chat Commands (in interactive mode)

- `/help` - Show available commands
- `/clear` - Clear conversation history
- `/cwd` - Show current working directory
- `/cd ` - Change working directory
- `/skill list` - List all installed skills
- `/skill list --anthropic` - List only Anthropic format skills
- `/skill install ` - Install a skill from GitHub (e.g., `anthropics/skills/algorithmic-art`)
- `/skill search ` - Search installed skills
- `/exit` - Exit the program

## Configuration

### Environment Variables

| Variable | Description | Default |
|----------|-------------|---------|
| `OPENAI_API_KEY` | Your OpenAI API key | Required |
| `OPENAI_BASE_URL` | Custom API endpoint | `https://api.openai.com/v1` |
| `OPENAI_MODEL` | Model to use | `gpt-4` |
| `AGENT_SKILL_PATHS` | Additional skill directories (colon-separated) | - |

### Example

```bash
export OPENAI_API_KEY=your-api-key
export OPENAI_BASE_URL=https://api.your-provider.com/v1  # optional
export OPENAI_MODEL=gpt-4  # optional
```

## Project Structure

```
src/
├── cli.ts                    # Interactive CLI entry point
├── index.ts                  # Main CLI (backward compatible commands)
├── types.ts                  # Re-exported types
├── agent/
│   ├── core.ts               # Agent core, handles LLM interaction
│   ├── prompt.ts             # System prompt definition
│   └── tools.ts              # Tool definitions and handlers
├── sandbox/
│   ├── core.ts               # Sandbox core interface
│   ├── executor.ts           # Command executor (stream hijacking)
│   ├── permission.ts         # Permission gateway
│   ├── session.ts            # Session state (CWD)
│   └── interactive.ts        # Interactive command support (PTY)
├── llm/
│   ├── provider.ts           # LLM abstract interface
│   └── openai.ts             # OpenAI-compatible implementation
├── skill/
│   ├── types.ts              # Skill type definitions (Anthropic & OpenClaw)
│   ├── discovery.ts          # Skill discovery
│   ├── executor.ts           # Skill execution
│   ├── anthropic-loader.ts   # Anthropic format loader (GitHub support)
│   └── registry.ts           # Unified skill registry
└── utils/
    ├── logger.ts             # Logging utility
    └── config.ts             # Configuration management
```

## Skill Format

Skills are defined in `SKILL.md` files with YAML frontmatter:

```markdown
---
name: my-skill
description: A brief description of the skill
homepage: https://example.com
metadata:
  openclaw:
    emoji: 🔧
    requires:
      bins: [node, python]
      env: [API_KEY]
---

# Skill Title

Documentation and usage examples...

## Commands

\`\`\`bash
node {baseDir}/scripts/my-script.js
\`\`\`
```

### Frontmatter Fields

- `name` (required): The skill name
- `description` (required): A brief description
- `homepage` (optional): URL to more information
- `metadata` (optional): JSON object with additional metadata
  - `openclaw.emoji`: Emoji displayed in listings
  - `openclaw.requires.bins`: Required binaries
  - `openclaw.requires.env`: Required environment variables

### Placeholders

- `{baseDir}`: Replaced with the skill's directory path

## Anthropic Skills Format

The project now supports the [official Anthropic Skills format](https://github.com/anthropics/skills).

### Skill Structure

```
skill-name/
├── SKILL.md          # Main file (YAML frontmatter + Markdown)
├── templates/        # Optional template files
│   └── viewer.html
└── LICENSE.txt       # Optional license
```

### SKILL.md Format

```markdown
---
name: algorithmic-art
description: Creating algorithmic art using p5.js
license: Complete terms in LICENSE.txt
---

# Algorithmic Art

Create beautiful algorithmic art with p5.js...

## Examples

- Generate geometric patterns
- Create animated visuals

## Guidelines

- Use p5.js for canvas operations
- Keep animations performant
```

### Installing Anthropic Skills

```bash
# In interactive mode
> /skill install anthropics/skills/algorithmic-art

# Or with full URL
> /skill install https://github.com/anthropics/skills/tree/main/skills/brand-guidelines
```

### Using Templates

Skills can include templates that can be rendered with custom variables:

```typescript
// Via LLM agent
await useTemplate('algorithmic-art', 'viewer.html', { title: 'My Art' });
```

### Storage Locations

- **OpenClaw Skills**: `~/.openclaw/workspace/skills/`
- **Anthropic Skills**: `~/.agent-skills/anthropic/repos/`

## Interactive Example

```
$ agent-chat
🤖 Agent CLI v1.0.0
工作目录: /home/user/projects/my-app
模型: gpt-4

输入您的问题或命令，按 Ctrl+C 退出
输入 /help 查看可用命令

> 帮我列出当前目录的文件
📁 执行: ls -la
...

> 运行 Python 计算 2+2
🐍 执行 Python 代码...
结果: 4

> rm -rf /
⚠️  高危命令需要确认
命令: rm -rf /
影响: 删除根目录下所有文件
[y/n] 是否执行? n
已取消

> 启动 Python REPL
🐍 进入交互式 Python...
>>> print("hello")
hello
>>> exit()
```

## Commands Summary

| Command | Alias | Description |
|---------|-------|-------------|
| `list` | `ls` | List all available skills |
| `run ` | - | Execute a skill |
| `info ` | - | Show skill documentation |
| `config` | - | Show current configuration |
| `chat` | - | Start interactive LLM agent session |

### Run Options

| Option | Description |
|--------|-------------|
| `-c, --command ` | Run a specific command |
| `-d, --dry-run` | Show what would be executed |
| `--help-skill` | Show skill documentation |

### Chat Options

| Option | Description |
|--------|-------------|
| `-v, --verbose` | Show detailed tool execution info |
| `-C, --cwd ` | Set working directory |

## Development

```bash
# Build
npm run build

# Run in development
npm run dev -- list
npm run dev:chat

# Run directly
npx ts-node src/index.ts list
npx ts-node src/cli.ts
```

## Dependencies

- `openai` - OpenAI SDK
- `node-pty` - PTY support (interactive commands)
- `inquirer` - Interactive CLI
- `chalk` - Colored output
- `uuid` - Temporary file naming
- `commander` - CLI framework
- `gray-matter` - Markdown frontmatter parsing
- `fs-extra` - Enhanced file system operations

## License

MIT