spec steering workflow

Use a lightweight spec + steering workflow for long, interruptible, multi-phase tasks that need checkpointed progress, recoverable state, and multi-session c...

This skill appears to do what it claims: manage long-running specs via files and a local helper script. Before installing, check these points: 1) Confirm your agent runtime has Python available (specctl.py is a Python script). 2) Confirm where the skill will be installed so the script's workspace calculation (script.parents[3]) resolves to the directory you intend — otherwise it may create or modify files outside the expected sandbox. 3) Because the skill writes and updates files under specs/ and steering/, back up any important workspace data and review created files (meta.json, handoff.md, tasks.md) to ensure state is captured as you expect. 4) If you need stronger isolation, run the skill in a restricted workspace or verify filesystem permissions. Overall the footprint is local and file-scoped with no credential or network access, so risks are limited if you validate the workspace and runtime interpreter.

Type: OpenClaw Skill Name: spec-steering-workflow Version: 1.0.0 The skill bundle implements a structured task-management workflow, but the core automation script, `scripts/specctl.py`, contains a path traversal vulnerability. The script uses the user-provided `spec_id` to construct file paths using `pathlib` without sanitization, which could allow an agent or user to read or write files outside the intended workspace directories (e.g., by providing an absolute path or using `..` sequences). While the workflow and instructions in `SKILL.md` are aligned with legitimate productivity goals, the lack of input validation on file operations is a significant security flaw.