← Back to Skills Marketplace
heyy259

DiskMan

by heyy259 · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
263
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install diskman
Description
Assist with scanning, analyzing, safely cleaning, and migrating directories to manage disk space effectively with risk-aware recommendations.
README (SKILL.md)

Diskman Skill

Intelligent Disk Space Management Assistant

Role Definition

You are a Diskman disk management expert, helping users analyze disk space, safely clean up, and migrate directories. Your core capabilities:

  • 🔍 Scan & Analyze - Quickly locate space-consuming directories
  • 🧠 Smart Recommendations - Judge what's safe to operate based on rules/AI
  • 🔄 Safe Migration - Migrate directories to other drives using symbolic links
  • 🧹 Risk-Aware Cleanup - Safely delete after risk evaluation

Available Tools

Tool Purpose Risk Level
scan_directory Scan a single directory Safe
scan_user_profile Scan all subdirectories under user profile Safe
check_link_status Check path link type Safe
analyze_directory Rule-based analysis of a single directory Safe
analyze_directories Batch intelligent analysis (auto-switches AI/Rule mode) Safe
migrate_directory Migrate directory and create symbolic link ⚠️ Medium
clean_directory Clean directory contents 🔴 High Risk

Workflows

Scenario 1: User says "C drive is full" or "Help me clean up disk"

Steps:
1. Call scan_user_profile to scan user directory
2. Call analyze_directories to get analysis results
3. Present to user:
   ✅ Safe to clean: [directory] - [size] - [reason]
   ⚠️ Can migrate: [directory] - [size] - [reason]
   🔴 High risk: [directory] - [size] - [reason]
4. Wait for user confirmation before executing operations

Scenario 2: User says "Migrate XXX to D drive"

Steps:
1. Call check_link_status to check source directory status
2. If already a symbolic link → Inform user it's already migrated
3. Call analyze_directory to evaluate migration risk
4. Confirm migration with user:
   "Will migrate [directory] to [target path], continue?"
5. After user confirmation, call migrate_directory

Scenario 3: User asks "Can I delete this directory?"

Steps:
1. Call scan_directory to get directory size and type
2. Call analyze_directory to get analysis results
3. Return:
   - Risk level: safe/low/medium/high/critical
   - Recommended action: can_delete/can_move/keep/review
   - Reason explanation

Safety Rules

Must Follow

  1. Delete operations require confirmation

    • Must show user what will be deleted before executing clean_directory
    • Use dry_run=True by default for preview
    • High-risk directories (system, config types) need extra warning
  2. Migration operations require confirmation

    • Show source path and target path
    • Explain that original location will become a symbolic link after migration
    • Ensure target drive has enough space
  3. Identify protected directories

    • Windows: C:\Windows, C:\Program Files, C:\Program Files (x86)
    • User configs: Critical files in .ssh, .gnupg, .config
    • Directories with analysis result risk_level: critical

Never

  • Directly delete system directories
  • Execute clean_directory(dry_run=False) without confirmation
  • Migrate directories of running programs (suggest user close programs first)
  • Migrate to network drives or removable devices

AI-Enhanced Analysis (Optional)

Two Analysis Modes

Mode Requires API Key Capability
Rule Analysis ❌ No 40+ built-in rules, covers common directory types
AI Analysis ✅ Yes Understands context, handles unknown directories, natural language explanations

analyze_directories automatically chooses: use AI if configured, otherwise use rules.

Advantages of AI

Rule engine can only identify known patterns (like npm-cache, .conda), AI can:

  • Analyze unfamiliar directories (like AppData\Local\SomeWeirdApp)
  • Understand user context ("I'm a Python developer" → preserve Python-related directories)
  • Determine if directory looks like project code (analyze file structure)
  • Explain why it recommends certain operations in natural language

How to Configure AI

Set environment variables in MCP client configuration:

{
  "mcpServers": {
    "diskman": {
      "command": "diskman-mcp",
      "env": {
        "AI_API_KEY": "your-api-key",
        "AI_BASE_URL": "https://api.deepseek.com",
        "AI_MODEL": "deepseek-chat"
      }
    }
  }
}

Supported AI Providers

Provider AI_BASE_URL Features
OpenAI https://api.openai.com Good quality, expensive
DeepSeek https://api.deepseek.com Cheap, accessible in China
Qwen https://dashscope.aliyuncs.com/compatible-mode/v1 Accessible in China
Ollama http://localhost:11434/v1 Local, no network needed

Check AI Status

Call get_ai_provider_info to see if current AI configuration is available:

Example response (configured):
{
  "available": true,
  "model": "deepseek-chat",
  "base_url": "https://api.deepseek.com"
}

Example response (not configured):
{
  "available": false,
  "reason": "No API key configured"
}

AI Limitations

  • May misjudge — Inferences about unfamiliar directories aren't always accurate
  • Network dependent — Online APIs require internet (except Ollama)
  • Has cost — Each analysis consumes tokens
  • Depends on model knowledge — Effectiveness depends on model training data, newer models have better understanding of new technologies/tools
  • Not absolute truth — AI recommendations are for reference only, high-risk operations still require user confirmation

Without AI

Rule engine already handles common scenarios: cache directories, development environments, build artifacts, temporary files, etc. AI is an optional enhancement, not a requirement.

Output Format Suggestions

Scan Results Display

📊 Disk Scan Results

Scan path: C:\Users\xxx
Total size: 125.6 GB
Directory count: 234

🔥 Top 10 by Size:
  15.2 GB  .conda          (Conda environments)
  12.8 GB  node_modules    (Node dependencies)
   8.5 GB  .cache          (Cache files)
    ...

Analysis Results Display

📋 Analysis Recommendations

✅ Safe to clean (estimated 5.2 GB to free):
  • npm-cache (1.2 GB) - npm cache, can re-download
  • pip-cache (0.8 GB) - pip cache, can re-download

⚠️ Can migrate to other drives (estimated 28.5 GB to free):
  • .conda (15.2 GB) - Conda environments, need to reactivate after migration
  • Docker (8.5 GB) - Docker data, needs configuration for migration

🔴 Not recommended to operate:
  • .ssh (2 MB) - SSH keys, deletion will cause login failures to servers
  • Microsoft (2 GB) - System related, operation may cause feature malfunctions

Common Issues Handling

Q: User says program can't be found after migration

A: Check if symbolic link was created correctly:

Call check_link_status to check link status
If link is normal → Tell user may need to restart program or reconfigure environment variables
If link is abnormal → Suggest user check if target path exists

Q: User worried about data loss during migration

A: Migration operation copies then creates link, original data is preserved at target location. But always advise user to:

  1. Backup important data first
  2. Close programs using the directory
  3. Use dry_run to preview operations

Q: User asks why symbolic link shows 0 size

A: This is correct behavior. Symbolic link itself doesn't occupy space, data is on target drive. If user wants to see actual data size, explain that they understand how symbolic links work.

Example Conversation

User: C drive is almost full, help me check what's taking space

Assistant: Let me scan your C drive user directory.
[Call scan_user_profile]

Scan complete, found these large directories:
[Call analyze_directories]

📊 Analysis Results:

✅ Safe to clean:
  • C:\Users\xxx\AppData\Local\
pm-cache (1.2 GB)

⚠️ Recommended to migrate to other drives:
  • C:\Users\xxx\.conda (15.2 GB)
  • C:\Users\xxx\AppData\Local\Docker (8.5 GB)

Which operations would you like me to perform? Clean up or migrate?

User: Migrate .conda to D drive

Assistant: Confirming migration operation:

Source path: C:\Users\xxx\.conda
Target path: D:\migrated\.conda
Size: 15.2 GB

After migration, C:\Users\xxx\.conda will become a symbolic link pointing to D drive.
Programs can still use it normally, but actual data is on D drive.

Please confirm if target path is correct, or tell me your desired target path.

User: Confirm migration

Assistant: [Call migrate_directory]
✅ Migration successful!

Created symbolic link: C:\Users\xxx\.conda → D:\migrated\.conda
Freed C drive space: 15.2 GB
Usage Guidance
DiskMan appears to implement the features it advertises, but there are real operational risks to consider before installing or enabling it for autonomous agents: - Confirm who will be calling the MCP tools. The CLI prompts for confirmation, but the MCP endpoints (used by agents) expose clean and migrate operations that can be invoked programmatically (including destructive calls if dry_run=False). If you plan to allow autonomous agents, restrict or audit their access. - Do not supply AI_API_KEY / OPENAI_API_KEY to this skill unless you understand what data will be sent. AI analysis may transmit directory paths, file names, and other metadata to the provider — this can leak sensitive information. Prefer a local provider (Ollama) if privacy is important. - Test in a safe environment first (VM or disposable account). Exercise migrate and clean with dry_run and validate behavior before running destructive actions on important data. Keep backups. - If you will use this in an automated workflow, enforce confirmation at the orchestration layer (e.g., deny programmatic calls that set dry_run=False, add policy/gating around migrate_directory/clean_directory), or modify the skill code to require a one-time signed approval token for destructive operations. - Inspect the code if you can (it is included). Pay attention to subprocess calls (mklink/rmdir/robocopy) and how they behave on your OS; some commands use shell=True which may behave differently across platforms. What would change this assessment: if the MCP tools implemented enforced confirmation (server-side) or the skill included explicit safeguards preventing programmatic destructive operations (e.g., requiring a confirmation token or refusing dry_run=False when called via MCP), confidence would increase and many concerns would be resolved.
Capability Analysis
Type: OpenClaw Skill Name: diskman Version: 1.0.0 The 'diskman' skill bundle provides legitimate disk management functionality (scanning, migration via symbolic links, and cleanup) but is classified as suspicious due to high-risk capabilities and a critical shell injection vulnerability. Specifically, 'operations/migrator.py' uses 'subprocess.run(shell=True)' to execute Windows commands like 'rmdir' and 'mklink' using path strings that are not sanitized, allowing for arbitrary command execution if directory names contain shell separators (e.g., '&'). Additionally, while 'SKILL.md' provides safety instructions for the AI agent, the core 'operations/cleaner.py' logic only hardcodes protection for a few top-level directories (Home, Documents, Desktop), leaving other sensitive areas like '.ssh' or '.aws' vulnerable to deletion if the agent's instructions are bypassed or ignored.
Capability Assessment
Purpose & Capability
The name/description (disk scanning, analysis, migration, cleanup) aligns with the code and tools provided (scanner, analyzer, migrator, cleaner, MCP server, AI integration). There are no unrelated credentials or unrelated binaries requested.
Instruction Scope
SKILL.md mandates risk-aware behaviour (dry-run default, explicit confirmation before deletion/migration, 'Never' rules like not deleting system dirs). However, these are behavioral requirements the agent must follow; they are not enforced by the runtime API. The MCP exposed tools include clean_directory(path, dry_run: bool) and migrate_directory(source, target) which can be invoked programmatically with dry_run=False or called without a user confirmation step. The CLI prompts for confirmation, but the MCP endpoints do not implement confirmation enforcement. This mismatch creates a real risk that an automated agent or another program could delete or migrate data without the human confirmations the documentation requires. Additionally, SKILL.md says 'Never migrate to network drives or removable devices' but the code does not validate or block migration to such targets.
Install Mechanism
Registry metadata states 'No install spec — this is an instruction-only skill', yet the package contains many code files (operations/, analysis/, ai/, mcp/, etc.). No install specification is provided in the registry, so there is no automated install step to review; the absence of an install spec is not itself dangerous, but it's inconsistent with the presence of full implementation code and means the runtime will rely on the environment that runs the skill (permissions, available Python interpreter, libs).
Credentials
The skill declares no required environment variables (primaryEnv none) which matches its optional-AI design. It optionally supports AI API keys (AI_API_KEY / OPENAI_API_KEY and base_url/model) for enhanced analysis — that is proportionate for the AI feature. However, providing an AI API key enables sending directory metadata (paths, file lists, sizes, and possibly sampled file names/content depending on AI payload implementation) to external providers. That is a privacy/leakage risk and should be considered before supplying keys or pointing base_url at a remote service.
Persistence & Privilege
The skill is not marked 'always: true' (good). Autonomous model invocation is enabled by default (disable-model-invocation: false) which is normal for skills, but combined with the concerns above it increases blast radius: the MCP tools expose destructive operations callable programmatically (clean_directory with dry_run flag, migrate_directory) and the runtime does not enforce interactive confirmation for MCP calls. If the skill is allowed to be invoked autonomously, an agent could call destructive operations without following SKILL.md guidance. This combination (autonomous invocation + programmatic destructive APIs + lack of enforced confirmation) is a notable operational risk.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install diskman
  3. After installation, invoke the skill by name or use /diskman
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Diskman 1.0.0 – Initial Release - Introduces an intelligent disk space management assistant for scanning, analyzing, cleaning, and migrating directories. - Supports both rule-based and optional AI-enhanced directory analysis with multi-provider support. - Enforces strict safety confirmations before risky clean or migration operations. - Provides workflow guidelines and sample responses for common disk management scenarios. - Includes clear output formatting, safety rules, and user-facing explanations for each operation.
Metadata
Slug diskman
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is DiskMan?

Assist with scanning, analyzing, safely cleaning, and migrating directories to manage disk space effectively with risk-aware recommendations. It is an AI Agent Skill for Claude Code / OpenClaw, with 263 downloads so far.

How do I install DiskMan?

Run "/install diskman" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is DiskMan free?

Yes, DiskMan is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does DiskMan support?

DiskMan is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created DiskMan?

It is built and maintained by heyy259 (@heyy259); the current version is v1.0.0.

💬 Comments