Workspace Indexer

自动扫描和更新 workspace 目录索引，记录目录用途、运行状态、相关记忆及搜索关键词，不深入分析项目文件。

This skill appears to do what it says—index workspace directories using memory lookups and shell commands. Before enabling automatic runs, consider: (1) review what your memory_search stores (conversation logs, sensitive notes) since the index will reference them; (2) restrict or audit the exec capability (run the skill manually first to see the exact commands it issues); (3) back up your workspace or run in a sandbox if you’re worried about accidental writes; (4) if you enable the suggested daily automation, add explicit checks to HEARTBEAT.md and confirm the agent’s permissions. If you need higher assurance, ask the author for an explicit list of the exact exec commands the skill will run when scanning and how it determines "running services/containers."

Type: OpenClaw Skill Name: workspace-indexer Version: 1.0.0 The skill's stated purpose of indexing workspace directories is benign, and the instructions in SKILL.md align with this goal. However, the skill explicitly requires and instructs the use of the 'exec' tool (as seen in skill.json and SKILL.md) for tasks like 'scanning workspace directory structure' and 'checking for running services/containers'. While these actions are plausible for an indexer, the 'exec' tool, if unconstrained or improperly handled by the AI agent, presents a significant vulnerability for arbitrary command execution. There is no evidence of intentional malicious behavior, but the reliance on a powerful and potentially dangerous tool makes this skill suspicious due to the inherent RCE risk.