Back to skill
Skillv1.0.0
ClawScan security
Filesystem Access · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 6, 2026, 3:13 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill claims to restrict file operations to the workspace, but it is instruction-only and provides no enforceable mechanism—so its stated safety depends entirely on the platform's sandboxing and the agent following vague rules.
- Guidance
- This skill is essentially a set of rules rather than an enforced sandbox. Before installing, verify how your OpenClaw runtime enforces 'workspace-only' file access (OS chroot/namespace, process-level sandbox, or an API that only exposes workspace paths). Ask the platform owner: does the agent process actually get prevented from reading/writing outside the workspace? If not, treat this as having full filesystem access and only enable it when you trust the agent and logs/auditing. Consider: 1) testing with a harmless file outside the workspace to confirm enforcement, 2) limiting autonomous invocation or requiring manual approval for file operations, 3) ensuring audit logs capture file reads/writes, and 4) avoiding giving this skill access if you must protect secrets or system files.
Review Dimensions
- Purpose & Capability
- concernThe name/description promise a safe, workspace-only file read/write/list capability. However, the skill requests no OS-level sandboxing, config paths, or credentials that would technically limit access to a workspace. For an actual workspace-only file-access feature, one would expect either platform-level enforcement details or instructions referencing a specific sandboxed API or path—those are missing.
- Instruction Scope
- concernSKILL.md contains policy-style guidance (use relative paths, do not write outside workspace) but no concrete, constrained commands or checks. That makes safe behavior advisory rather than enforced: an agent could ignore the guidance and access arbitrary files unless the runtime enforces limits.
- Install Mechanism
- okNo install spec and no code files are present. That minimizes supply-chain/code-execution risk because nothing is downloaded or installed by the skill itself.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. There are no disproportionate secret requests.
- Persistence & Privilege
- noteThe skill is default-autonomous-invocable (platform default). While 'always: true' is not set, the combination of autonomous invocation and non-enforced, advisory constraints increases the risk that the agent could access files outside the workspace without explicit user approval.