File Manager Service

• Analyzed: May 11, 2026, 6:25 AM
• Findings: 1
• Version: 1.1.3
• Hash: 56a1e13a18e02fb2d7212462b0bb62b87dd638da93ee48abc5d7e9833d21895d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The file-manager-service bundle provides a legitimate Flask-based utility for managing files within a specific workspace (~/.openclaw/workspace/projects). The implementation in scripts/server.py includes robust security checks using Path.relative_to() to prevent path traversal attacks across all API endpoints (upload, delete, move, read). While the service lacks authentication and listens on all interfaces (0.0.0.0:8888), which is a significant security vulnerability if exposed to a network, there is no evidence of malicious intent, data exfiltration, or unauthorized persistence mechanisms. The code logic is transparent and aligns with the stated purpose of providing a Web UI and CLI for file management.