Touch Tool

PassAudited by VirusTotal on May 5, 2026.

Overview

Type: OpenClaw Skill Name: touch-tool Version: 1.0.0 The skill provides a basic file creation utility similar to the Unix 'touch' command. While the documentation in SKILL.md claims support for several flags (e.g., -a, -m, -t) that are not actually implemented in the scripts/touch.py code, the script itself is a simple and safe Python implementation that only performs standard file append/close operations.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked with the wrong path, it can create empty files or alter file metadata in locations the current user can write.

Why it was flagged

The script creates or opens whichever file paths are supplied. This matches the tool's purpose, but it is still local filesystem mutation.

Skill content

for f in args.files:
    try:
        open(f, 'a').close()
        print(f"Created: {f}")

Recommendation

Use it only with intended file paths and avoid important or protected directories unless you explicitly want to create or touch a file there.

Note

ASI09: Human-Agent Trust Exploitation

What this means

Users may expect timestamp or no-create behavior that the included script will not provide, leading to failed commands or incorrect expectations.

Why it was flagged

The documentation advertises touch-style options, but the included script only defines a positional files argument and does not implement these options.

Skill content

- `-a`: Change access time only
- `-m`: Change modification time only
- `-t STAMP`: Use specified time instead of current time
- `-c`: Don't create file if it doesn't exist

Recommendation

Treat the current implementation as simple file creation/opening only, or update the script or documentation before relying on timestamp options.