OpenClaw hardened skill download target directory validation
OpenClaw issued a security advisory for a moderate severity vulnerability (CVE-2026-27008) in versions up to 2026.2.14 where skill download installation could write files outside the intended sandbox due to insufficient validation of targetDir values.
What happened
A bug in OpenClaw's skill download installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated.
In the admin-only skills.install flow, this could write files outside the intended install sandbox.
Governance controls
The vulnerability was patched in version 2026.2.15, restricting the download installer targetDir to the per-skill tools directory to prevent arbitrary file writes.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.