Workspace目录清理工具

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:12 AM UTC
• Version: 1.0.0

Overview

This workspace cleanup skill is coherent, but it broadly inspects sensitive OpenClaw workspace, memory, and cron state before confirmation and can later move or delete files.

Review this before installing if your OpenClaw workspace contains private user notes, long-term memory, or cron content. Use it only when you are comfortable with the agent seeing filenames and matching lines under ~/.openclaw/workspace and ~/.openclaw/cron, and confirm exact source and destination paths before approving any move or deletion. There is no artifact evidence of remote exfiltration, hidden persistence, or automatic destructive action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Overbroad Scanning of Sensitive Workspace State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: Overbroad access to agent workspace and persistent state
Risk Level: Medium

Vulnerable Code

bash

grep -r "filename" ~/.openclaw/workspace/*.md
grep -r "filename" ~/.openclaw/cron/

Technical Analysis

The skill instructs the agent to search every Markdown file in the workspace root and recursively search the cron directory. According to the documented workspace model, root Markdown files can include USER.md and MEMORY.md, which may contain personal information and persistent agent memory.

Returning matching lines gives the operation access to file contents rather than only the reference metadata required for workspace organization. This violates least-privilege principles because reference discovery can be performed by returning only file paths or by searching a narrowly defined allowlist.

The commands do not transmit information over a network, alter permissions, or establish persistence. The risk is limited to unnecessarily exposing sensitive workspace content to the active agent context and any generated report.

Attack Path

1. Sensitive information is stored in a root Markdown file such as USER.md or MEMORY.md, or in a cron configuration file.
2. A filename or chosen search term also appears on a line containing that sensitive information.
3. The workspace-cleaner skill executes the unrestricted recursive search.
4. grep returns the complete matching line rather than only the name of the referencing file.
5. The sensitive line enters the command output and may subsequently be incorporated into the conversation or audit report.

Impact Assessment

The issue can disclose matching portions of personal information, long-term agent memory, configuration instructions, or scheduled-task content available to the current user account. It does not independently provide elevated operating-system pr ...[truncated 120 chars]

Remediation

View remediation

Remediation Suggestions

• Search an explicit allowlist of non-sensitive configuration files instead of all root Markdown files.

• Exclude USER.md, MEMORY.md, and other sensitive state files by default.

• Request explicit user consent before inspecting persistent memory or personal-information files.

• Return only referencing file names rather than matching content, for example:

  bash

  grep -rlF -- "$filename" "${approved_files[@]}"
  

• Apply equivalent scope restrictions to the cron directory.

• Redact secrets and personal data before including search results in a generated report.

• Display the exact search scope to the user before accessing sensitive workspace state.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:13

Finding

Unsafe Interpretation of Filenames as Grep Patterns or Options

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: Unsafe command argument handling
Risk Level: Low

Vulnerable Code

bash

grep -r "filename" ~/.openclaw/workspace/*.md
grep -r "filename" ~/.openclaw/cron/

Technical Analysis

The skill directs the agent to execute these searches for each filename, but the filename is used as a regular-expression pattern. A filename containing regular-expression metacharacters such as ., *, [, ], or ^ can therefore match content unrelated to the literal filename.

The command also lacks the -- option terminator. Depending on how the placeholder is replaced and how the command is invoked, a filename beginning with a hyphen may be interpreted by grep as an option rather than as search data.

Although the displayed placeholder is quoted and therefore does not by itself establish arbitrary shell-command injection, incorrect pattern and option handling can corrupt the reference analysis. That corrupted analysis may influence later move or deletion recommendations.

Attack Path

1. An attacker or untrusted process creates a workspace file whose name contains regular-expression metacharacters or begins with a hyphen.
2. The skill uses that filename as the grep search pattern.
3. grep interprets the name as regular-expression syntax or, depending on invocation, as a command-line option.
4. The search produces false positives, false negatives, an error, or unexpectedly broad output.
5. The skill incorrectly reports whether the file is referenced.
6. During the cleanup phase, the user may approve a move or deletion based on the inaccurate report.

Impact Assessment

The primary impact is loss of integrity in the workspace analysis. In the worst documented workflow outcome, a legitimate file could be incorrectly recommended for relocation or deletion. Actual modification still requires user approval under the skil ...[truncated 141 chars]

Remediation

View remediation

Remediation Suggestions

• Use fixed-string matching so filenames are not interpreted as regular expressions:

  bash

  grep -rFl -- "$filename" ~/.openclaw/workspace/*.md ~/.openclaw/cron/
  

• Always include -- before attacker-influenced or workspace-derived arguments.

• Keep filenames in shell variables or arrays and never construct commands through textual concatenation or eval.

• Validate that each candidate path remains within the intended workspace using canonicalized paths.

• Use null-delimited file discovery when iterating over arbitrary filenames.

• Before any move or deletion, present the exact source path, destination path, and reference evidence as a dry run.

• Recalculate references with literal matching immediately before performing an approved cleanup action.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language instructions, triggers, and user-facing prompt all assume Chinese as the required language. There is no opt-in language selection or explanation that this skill is intentionally limited to Chinese-speaking users or a Chinese-only deployment context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to match ordinary user requests about inspecting or cleaning a workspace, which can cause this skill to activate unexpectedly. Because the skill proceeds to inspect filesystem contents and then solicits approval for moving or deleting files, overbroad invocation increases the risk of unintended file operations from ambiguous prompts.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This step explicitly enumerates files under ~/.openclaw/workspace, exposing directory names and potentially sensitive filenames or hidden artifacts to the agent and any generated report. In context, enumeration is part of the skill's intended function, which makes it less suspicious than covert discovery, but it still expands access to local filesystem metadata and can feed later destructive actions such as move or delete decisions.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

1. 列出workspace根目录所有文件和目录

bash

ls -la ~/.openclaw/workspace/

2. 检查核心文件的引用关系