Workspace Hygiene — Auto-Clean for AI Agents

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This cleanup skill is understandable and not deceptive, but it can automatically change or delete important agent workspace files without a review step.

Install only if you intentionally want unattended workspace maintenance. Before enabling cron or auto-runs, review the hardcoded /root/.openclaw/workspace path, back up AGENTS.md, MEMORY.md, STATE.md, USER.md, and memory notes, and consider changing deletion to archive-only or dry-run behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manual trigger phrase "clean up" is broad enough to plausibly appear in ordinary conversation, which could cause the skill to run unintentionally. Because this skill performs file moves, archiving, and deletion-related actions, accidental invocation can change workspace state without a clearly scoped confirmation step.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly allows deletion of empty files and otherwise performs automated cleanup actions without any user-facing warning or approval workflow about potential data impact. Even if most actions archive rather than delete, destructive behavior in a background or cron-triggered maintenance skill creates a real risk of unintended data loss or removal of files that were intentionally kept minimal.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script automatically moves, truncates, and deletes workspace files on a cron schedule with no confirmation, dry-run mode, backup validation, or integrity checks. In this context, it operates on agent memory and control files under /root, so mistakes, unexpected filename matches, or logic bugs can silently destroy important state and hinder auditing or recovery.

VirusTotal

66/66 vendors flagged this skill as clean.