T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync_helper.py:105- Finding
Unvalidated iCloud Vault Content Can Replace Active OpenClaw Skills and Configuration
- Content
View full analysis
bool: """Check if a vault is a valid OpenClaw vault. A valid OpenClaw vault must have: 1. .obsidian directory (identifies it as an Obsidian vault) Note: openclaw.json is recommended but not strictly required. It may exist in iCloud as a template, and locally with machine-specific config. """ return (vault_path / ".obsidian").exists() ``` The selected vault's content is then used to replace local OpenClaw entries: ```python # Create core directory symlinks for dir_name in core_dirs: src = helper.icloud_vault / dir_name if src.exists(): symlink_path = helper.local_vault / dir_name if symlink_path.exists() or symlink_path.is_symlink(): symlink_path.unlink() symlink_path.symlink_to(src) print(f" ✓ Created: {dir_name}") created_count += 1 # Create workspace symlinks for ws in sorted(workspaces): src = helper.icloud_vault / ws symlink_path = helper.local_vault / ws if symlink_path.exists() or symlink_path.is_symlink(): symlink_path.unlink() symlink_path.symlink_to(src) print(f" ✓ Created: {ws}") created_count += 1 # Create config file symlinks if config_files: local_openclaw_dir = helper.local_vault / ".openclaw" local_openclaw_dir.mkdir(exist_ok=True) for config_file in config_files: file_name = config_file.replace(".openclaw/", "") src = openclaw_dir / file_name symlink_path = local_openclaw_dir / file_name if symlink_path.exists() or symlink_path.is_symlink(): ...[truncated 3003 chars]- Remediation
View remediation