← 返回 Skills 市场
246
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install scratch-file-writer
功能描述
Safely write or append text content to files ONLY in /home/alfred/.openclaw/workspace/scratch. Creates backups before overwriting ({filename}.bak, .bak.1, et...
安全使用建议
This skill is not clearly malicious, but it has inconsistencies and a small risk of being misused. Before installing or enabling autonomous use: (1) reconcile allowed extensions (SKILL.md lists .txt/.md/.log/.json; references/safety.md also includes .py — decide whether .py is allowed and update docs and code accordingly); (2) update scripts/backup_file.sh so it enforces the same base_dir restriction (reject or canonicalize paths outside /home/alfred/.openclaw/workspace/scratch) and produce backup filenames that match the documented pattern (e.g., file.bak, file.bak.1); (3) ensure any content passed into shell fallbacks is safely escaped or avoided — prefer the agent's native 'write' tool over generating echo/>> shell commands; (4) test edge cases (no extension, many dots, symlinks, absolute path attempts, ../ attempts) to confirm sanitization works end-to-end; (5) if you enable autonomous invocation, limit or monitor the agent's ability to call 'exec' or the backup script until the above fixes are applied. If you want, I can produce a corrected backup script and a stricter path-validation snippet to replace the bundled script.
功能分析
Type: OpenClaw Skill
Name: scratch-file-writer
Version: 1.0.0
The 'scratch-file-writer' skill is a utility designed to manage text files within a restricted workspace directory (/home/alfred/.openclaw/workspace/scratch). It includes robust safety instructions in SKILL.md and references/safety.md, such as path sanitization to prevent directory traversal (rejecting '../' and absolute paths), extension whitelisting, and mandatory user confirmation for overwrites. The bundled script scripts/backup_file.sh performs standard file operations for versioning backups and contains no malicious logic or network activity.
能力评估
Purpose & Capability
The skill claims to be limited to /home/alfred/.openclaw/workspace/scratch and to text files only, which is reasonable. However, the bundled script (scripts/backup_file.sh) and references/safety.md introduce inconsistencies: safety.md allows .py files while SKILL.md's Quick Start list does not, and the bash backup script accepts an arbitrary FULL_PATH and will operate on any path it is given. That means the code included with the skill does not itself enforce the declared directory restriction, creating a plausible path for misuse if the agent or a user passes an absolute or outside-scratch path to the script. These mismatches are disproportionate to the simple 'scratch file writer' purpose.
Instruction Scope
SKILL.md contains clear runtime instructions (sanitize relative paths, confirm overwrites, create backups, limit size, allowed extensions). It sensibly requires confirmations and size limits. Two concerns: (1) fallback instructions suggest constructing shell commands like echo "[content]" > [full_path], which can be unsafe if content is not escaped and could lead to shell interpretation or accidental execution; (2) the included backup script's behavior (cp using the provided FULL_PATH) is not constrained by the same sanitization rules described in the instructions, so if the agent calls it incorrectly it can act outside stated scope.
Install Mechanism
No install spec (instruction-only with a small bundled script). This is low-risk from an installation perspective because nothing is downloaded or written at install time.
Credentials
The skill requests no environment variables, credentials, or special config paths — appropriate for a local file-writing helper. It does rely on agent tools ('read', 'write', 'exec') which are normal for skills that manipulate files; those capabilities should be reviewed in the agent environment but are not disproportionate to the stated purpose.
Persistence & Privilege
always is false and the skill does not request permanent/privileged presence. It does not attempt to modify other skills or system-wide agent settings. Autonomous invocation is allowed by default; this is normal but consider the other flagged issues before enabling autonomous use.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install scratch-file-writer - 安装完成后，直接呼叫该 Skill 的名称或使用
/scratch-file-writer触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial version for scratch writes
元数据
常见问题
File Writer 是什么？
Safely write or append text content to files ONLY in /home/alfred/.openclaw/workspace/scratch. Creates backups before overwriting ({filename}.bak, .bak.1, et... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 246 次。
如何安装 File Writer？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install scratch-file-writer」即可一键安装，无需额外配置。
File Writer 是免费的吗？
是的，File Writer 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
File Writer 支持哪些平台？
File Writer 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 File Writer？
由 Nagilem（@nagilem）开发并维护，当前版本 v1.0.0。
推荐 Skills