Workspace Anchor

Manages multi-agent projects by discovering, listing, switching, and validating workspace anchors using environment paths to prevent context drift.

Security Scan

The skill generally matches a 'project anchor' purpose, but contains inconsistent implementations (different .project-lock formats), broken shell command usage, and multiple shell execs over user paths that create command-injection and data‑exfiltration risks — review and fix before trusting it.

Purpose & Capability

Name/README and most code (discover, list, switch, validate, create) align with a workspace/project-lock manager. However there are clear inconsistencies: README/SKILL.md and discover/validate expect a plain-text '.project-lock' format with 'NAME:'/'ROOT:' lines, but create.js writes JSON. cli.js.runCommand is implemented in a way that recursively calls itself (likely a bug). These mismatches mean the components won't interoperate as expected.

Instruction Scope

SKILL.md explicitly tells agents to 'use exec' to find .project-lock files and 'identify absolute paths' — and the code uses execSync()/find/cat/grep/sed to scan the filesystem and read lock files. That behavior is within the stated goal (discovering lock files) but grants broad filesystem access and executes shell commands with interpolated paths. There are also fragile/malformed shell invocations (see validate.getCurrentProject) that may fail or behave unpredictably. The agent instructions are prescriptive and give the agent wide discretion to search arbitrary paths, which increases risk.

Install Mechanism

No install spec (instruction-only at registry level) — low install risk. But the package includes executable code files that will run when invoked; since nothing is installed by a package manager the code will be executed directly from the skill directory. This is not a contradiction but users should note code execution occurs despite 'no install'.

Credentials

The skill declares no required env vars, which is reasonable, but the code reads process.env (HOME, USERPROFILE) and allows expansion of arbitrary env variables (e.g., $CLAWD_ROOT). That's expected for path expansion, but because inputs from env/config end up inside shell commands (find, bash -c) there is a nontrivial risk if those environment values are malicious or untrusted. No external credentials are requested.

Persistence & Privilege

The skill does not request 'always: true' and is user-invocable. It performs filesystem reads/writes (create can write .project-lock files) and executes child processes — appropriate for its purpose. Note: autonomous invocation plus filesystem access increases blast radius compared to purely read-only skills, but there is no special persistent privilege requested by the skill itself.

What to consider before installing

This skill mostly does what its README says (find and manage .project-lock project files), but there are several red flags you should address before installing or running it on sensitive systems: - Interoperability bugs: create.js writes JSON lock files while discover/validate expect a plain-text NAME:/ROOT: format — the tool may not work as intended and could overwrite or create unusable lock files. - Broken shell command: validate.getCurrentProject contains a malformed execSync('bash -c ...') string; it will likely fail and may produce unexpected shell behavior. - Shell execution risks: the code runs find, cat, grep, sed and other shell commands with interpolated paths. If any path or env value is attacker-controlled or contains quoting characters, this could lead to command injection or accidental reading of unrelated files. Prefer replacing shell calls with native Node FS traversal or robustly sanitize/escape inputs. - File-write behavior: createLockFile will write .project-lock to arbitrary provided directories and may overwrite existing files without prompting. Recommendations: - Do not run this skill as a privileged user; test it in a disposable environment first. - Review and fix the create/discover format mismatch (choose either the textual protocol or JSON and make all components consistent). - Fix the malformed shell quoting in validate.getCurrentProject and remove unsafe shell pipelines; use native fs operations where possible. - Add explicit input sanitization/escaping for any path used in execSync, or avoid execSync entirely for path searches. - If you need the functionality but cannot audit/fix the code, avoid installing in environments with sensitive data. If the owner can provide an updated release that removes shell pipelines (or properly sanitizes inputs) and fixes the format/logic bugs, that would raise confidence in the skill.

Multi-agent workspace awareness and safety system. Discovers, lists, switches, and validates projects using environment-based naming to prevent agent drift.

🤖 Agent Instruction (CRITICAL)

Before using this skill, you MUST identify the correct absolute paths for the user's environment. Use exec to find .project-lock files if paths are ambiguous.

📝 CLI Commands

• discover: Find all .project-lock files.
• list: Show formatted list of anchors.
• create <path>: Initialize a new anchor.
• switch <name>: Change active context.
• validate <path>: Check if path is within current anchor.