Workspace Maintenance

Maintain workspace documentation hygiene and discoverability. Use when organizing markdown sprawl, updating doc indexes, archiving stale progress/status snap...

This skill is not clearly malicious, but it has red flags you should address before installing or running it. The bundled script is hard-coded to /Users/ineluxx/... which makes it specific to one environment — change the script to accept a configurable workspace root (or use an environment variable) and test on a disposable copy first. Be cautious because SKILL.md allows broad file-moving steps that are not implemented in code; ensure any automated 'move' actions are explicit, reversible (keep manifests), and reviewed by a human. Run the dry-run output and inspect it before performing any moves; restrict the agent's permissions so it cannot modify unrelated system or other users' files. If you don't control the script source, ask the author why paths are hard-coded and request a configurable version or remove the script entirely.

Type: OpenClaw Skill Name: workspace-maintenance Version: 1.0.0 The skill bundle is designed for non-destructive workspace maintenance, generating dry-run reports of files for review. The `SKILL.md` explicitly states constraints like 'Never delete files automatically' and 'Always produce a dry-run candidate report'. The `scripts/archive-retention-audit.sh` script adheres to this by using `find` to list files older than 30 days and writing them to a local `DELETE-DRYRUN-*.txt` file, explicitly stating 'NO DELETE EXECUTED'. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. Hardcoded paths in the script are specific to the developer's environment but do not pose a security risk.