Workspace Temp

• Analyzed: May 11, 2026, 6:20 AM
• Findings: 1
• Version: 1.1.5
• Hash: 7abf46cd4bd4b0297085e022298f75314de1ddb2fbe473dd2e156f1c3f661519
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill manages temporary files but requires the agent to read the global `~/.openclaw/openclaw.json` configuration file to determine the workspace path. This file is a high-value target as it typically contains sensitive API keys and credentials, and granting an agent read access to it poses a significant risk of accidental secret exposure. Additionally, the instructions in `SKILL.md` direct the agent to copy external files into the workspace, which could be leveraged to ingest sensitive data into the agent's processing context.