Security audit
Security checks for vulnerabilities and agentic risk
This file-management skill mostly matches its stated purpose, but its implementation can run unintended shell commands and uses paths that break the promised workspace boundary.
Review before installing. Only use this skill in a disposable or tightly sandboxed workspace until it replaces shell-string exec with argument-safe execution, resolves the bundled script relative to the package, enforces real cwd containment, and documents or removes home-directory logging and destructive actions.
index.ts:22Shell Command Injection Through Unescaped Skill Input
scripts/file_manager.sh:66Working-Directory Sandbox Escape Through Symbolic Links
index.ts:35Hard-Coded External Script Path Bypasses the Audited Package
scripts/file_manager.sh:83Documented File-Size Limit Is Not Enforced
The description promises operations in the working directory, yet the documentation includes directory creation, file deletion, and logging to ~/.openclaw/logs/file-manager.log, which touches resources outside cwd. Such understated capability expansion can bypass user expectations and policy controls, especially when a skill is approved based on manifest text rather than full implementation details.
The description promises operations in the working directory, yet the documentation includes directory creation, file deletion, and logging to ~/.openclaw/logs/file-manager.log, which touches resources outside cwd. Such understated capability expansion can bypass user expectations and policy controls, especially when a skill is approved based on manifest text rather than full implementation details.
The example appends to /var/log/automation.log using an absolute path, directly contradicting the stated cwd sandbox and demonstrating modification of a system-level location without warning. This is dangerous because examples strongly shape agent behavior, and a copied pattern could lead to unauthorized or sensitive file changes outside the intended workspace.
The code claims safe file I/O within cwd, but it constructs a shell command by interpolating unescaped user-controlled arguments like path, dir, content, and pattern into a single exec string. An attacker can inject shell metacharacters through these fields and execute arbitrary commands, potentially reading, modifying, or destroying data or escaping the intended file-management scope.
The skill shells out to an external script using child_process.exec, which introduces command execution risk well beyond simple local file management. Because user-controlled values are later concatenated into the shell command, this design materially increases the attack surface and can enable arbitrary command execution in the agent runtime.
The skill claims operations are limited to the session working directory, but log() writes to ${FILE_MANAGER_LOG:-$HOME/.openclaw/logs/file-manager.log}, which is outside that boundary by default. This breaks the confinement model and can create or modify files in the user's home directory, potentially leaking file names and activity metadata across sessions or into persistent storage.
The manifest description states the skill works within the session working directory, but the documented behavior includes access outside cwd. This weakens trust in the skill’s declared boundary and can cause inappropriate auto-selection or authorization under an overly narrow security assumption.
The skill description is broad enough to match many ordinary requests involving files, which increases the chance of over-invocation for tasks that do not require write, delete, or directory manipulation privileges. In an agent ecosystem, vague trigger language can expand the operational footprint of a powerful skill and raise the risk of unintended file modification or data exposure.
The capability list advertises write, append, delete, and copy/move functionality without clearly warning that these actions can overwrite, alter, or remove user data. Missing warnings lower operator caution and make accidental destructive use more likely, particularly when the skill is presented as 'safe' by default.
The skill is explicitly designed to persist data across the session by writing, appending, deleting, and moving local files. Persistence is not inherently malicious, but it creates a real security concern because sensitive outputs, prompts, or derived artifacts may remain on disk and be modified or reused in unintended ways.
## Capabilities
- **Read file**: Get contents of a text file
- **Write file**: Create or overwrite a file
- **Append file**: Add content to existing file
- **List files**: Directory listing with filtering
- **Delete file**: Remove a file (with safety checks)
The safety section claims cwd sandboxing, but later examples and configuration describe absolute-path writes and home-directory logging outside that boundary. Contradictory safety documentation is dangerous because operators may rely on the sandbox claim when enabling the skill, while actual usage patterns normalize broader filesystem access.
The skill metadata and description present a narrower capability set than the actual exposed commands, which also include directory creation and file deletion. This mismatch can mislead users, reviewers, or policy layers into granting access under false assumptions, increasing the chance of destructive file operations being invoked unexpectedly.
This code accepts actions including file-write, file-append, file-mkdir, and file-delete, then executes an external shell script via child_process without any confirmation prompt or user-visible warning in the code path. Although the skill description mentions file I/O generally, it does not specifically disclose deletion or shell execution behavior, and there are no logs, prompts, comments, or other user disclosures around these safety-relevant operations.
The manifest says the skill can read, write, append, and list local files in the working directory, but the CLI also exposes mkdir and delete actions. Creating directories and deleting files are materially broader behaviors than the stated description and are not implied by the listed capabilities.
The safety comment states paths are resolved within the cwd, but the function only strips a leading slash and rejects ..; it does not canonicalize or verify that the final target stays under the intended workspace. This can create a false sense of security, and in contexts with symlinks or manipulated CWD, file operations may reach unintended locations despite the apparent guard.
This code path deletes a file with rm after only validating existence and hidden-file status. While the action name implies deletion, there is no confirmation prompt, warning message, or inline disclosure at the point of execution to alert users before the irreversible operation occurs.
The manifest description advertises broader capabilities such as directory traversal, search, move, and delete, which exceed the narrower stated purpose of safely reading, writing, appending, and listing files in the workspace. Overstating capabilities can normalize unnecessary privilege requests and encourage use beyond the intended trust boundary, increasing the chance of destructive or policy-violating file operations.
Granting delete permission across the entire workspace is broader than necessary for a skill described primarily as a local file manager for persisting output and reading input safely. If the skill is misused, compromised, or invoked incorrectly, this permission enables irreversible destruction of user data within the workspace.
The trigger list includes multiple Chinese-only activation terms such as '文件', '读取', '写入', '写文件', and '读文件', but the skill does not document that it is intended specifically for Chinese-language users or offer any language/locale choice. This creates a natural-language policy concern because the skill behavior is partially scoped by language without explicit opt-in or justification.
The manifest description is written entirely in Chinese, which may impose a language expectation on users without any documented opt-in or locale justification. The policy requires avoiding fixed language constraints unless the skill clearly offers a choice or documents a justified region-specific scope.
No suspicious patterns detected.