OpenClaw symlink following vulnerability in skill packaging script
OpenClaw's skill packaging script was vulnerable to symlink following, which could allow unintended disclosure of local files into generated .skill archives during the skill authoring process. The vulnerability was patched in version 2026.2.18 by rejecting symlinks and adding validation tests.
What happened
The skill packaging script in OpenClaw (skills/skill-creator/scripts/package_skill.py) followed symlinks while building .skill archives. If an author ran this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive could include unintended file contents.
The vulnerability affected OpenClaw versions up to 2026.2.17. The issue was patched in version 2026.2.18 by rejecting symlinks during skill packaging.
Reported impact
Potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact. The attack required local execution of the packaging script on attacker-controlled skill contents.
Index analysis
The vulnerability was classified as low severity because it had no remote trigger and was not reachable via normal OpenClaw gateway/chat runtime paths. Exploitation required local/manual workflow execution only.
Governance controls
The fix added symlink detection and rejection during skill packaging, added regression tests for symlink file and symlink directory cases, and updated packaging guidance to document the symlink restriction.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.