Read-only file browsing and reading in the OpenClaw workspace (/home/alfred/.openclaw/workspace). Use for listing directories or reading text files (up to 10...

This skill generally does what it says, but do not install blindly: the scripts allow symlink traversal (a file inside the workspace that is a symlink could let the skill read files outside the workspace) and build JSON by directly embedding filenames and file contents without proper escaping (filenames or file contents with quotes/newlines/backslashes can corrupt JSON or be abused). Recommended mitigations before use: 1) resolve and verify the absolute path (e.g., realpath or readlink -f) and ensure it has the workspace prefix to block symlink/outside reads; 2) refuse to follow symlinks or explicitly check for and reject symlinks if you want strict confinement; 3) produce JSON safely (use a JSON encoder such as jq, Python's json.dumps, or printf with proper escaping) rather than interpolating raw data; 4) harden filename handling (handle newlines and quotes, or return names via null-separated output); and 5) validate parsed JSON before using results. If you cannot patch the scripts, consider running the skill in a restricted environment or rejecting it. Confidence is medium — code is small and readable, but the above issues are real and should be fixed before trusting the skill with sensitive workspace contents.

Type: OpenClaw Skill Name: file-browser Version: 1.0.0 The skill provides file browsing and reading capabilities within a restricted workspace, but it contains a vulnerability in the manual construction of JSON responses in 'scripts/list_files.sh' and 'scripts/read_file.sh'. Because file contents and filenames are not escaped before being inserted into the JSON string, a file containing double quotes or JSON-like structures could cause the agent to misinterpret the output, leading to indirect prompt injection. While the path sanitization correctly checks for '..' and absolute paths, the improper output encoding is a flaw that could be exploited to manipulate the agent's behavior.