Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Avoid noisy skill-path escape warnings for sibling skill references [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#62495•Fetched 2026-04-08 03:03:32
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
apoapostolovapoapostolov
Participants
apoapostolovapoapostolov
Timeline (top)
cross-referenced ×1referenced ×1

Fix Action

Fixed

PR fix notes

PR #62518: fix(skills): downgrade escaped skill-path warning from warn to debug

Description (problem / solution / changelog)

Summary

Fixes #62495 — noisy startup warn-level log for intentional sibling skill references.

  • Root cause: warnEscapedSkillPath in src/agents/skills/workspace.ts logged at warn level whenever a workspace skill directory (or its SKILL.md) resolved via symlink to a path outside the configured skills root — including sibling skill references the user set up intentionally.
  • Fix: Changed skillsLogger.warn → skillsLogger.debug in warnEscapedSkillPath. The security containment check is fully preserved — skills that escape the root are still silently skipped — only the log verbosity changes.
  • Bonus fix: Removed unused imports from src/config/config.legacy-config-detection.rejects-routing-allowfrom.test.ts that were causing a pre-existing oxlint failure in main.

Test plan

  • Existing symlink-escape tests still pass (skill is skipped, containment preserved)
  • New test "silently skips sibling skill directories that resolve outside the workspace skills root" passes on non-Windows
  • Run: node scripts/run-vitest.mjs run --config vitest.agents.config.ts src/agents/skills.loadworkspaceskillentries.test.ts → 15/15 pass
  • No warn-level log emitted during normal startup for intentional sibling skill symlinks

🤖 Generated with Claude Code

Changed files

  • src/agents/skills.loadworkspaceskillentries.test.ts (modified, +31/-0)
  • src/agents/skills/workspace.ts (modified, +1/-1)
RAW_BUFFERClick to expand / collapse

OpenClaw currently logs Skipping skill path that resolves outside its configured root. for a normal sibling reference in workspace/skills/openclaw-local/SKILL.md:

  • openclaw-local links to ../openclaw-optimisation/SKILL.md
  • the loader treats that Markdown link as an escaped skill path
  • this produces repeated startup noise even though the reference is intentional and valid from a documentation perspective

Suggested fix:

  • do not treat Markdown links in SKILL.md as enforceable skill-path inputs when they point to another skill doc
  • or allow sibling skill references in skill docs without logging them as escapes
  • if the loader must keep path validation, use a non-link reference format for cross-skill pointers that does not get parsed as a skill path

This is low severity, but it is noisy and misleading in startup logs.

extent analysis

TL;DR

Modify the loader to ignore Markdown links in SKILL.md files or use a non-link reference format for cross-skill pointers to prevent logging sibling references as escapes.

Guidance

  • Review the loader's path validation logic to determine why Markdown links are being treated as enforceable skill-path inputs.
  • Consider adding a configuration option to allow sibling skill references in skill docs without logging them as escapes.
  • Update the documentation to recommend using a non-link reference format for cross-skill pointers if the loader must keep path validation.
  • Verify that the fix does not introduce any security vulnerabilities or unintended behavior.

Example

No code snippet is provided as the issue does not contain sufficient technical details.

Notes

The suggested fix may require changes to the loader's logic or configuration, and careful consideration should be given to ensure that the fix does not introduce any security vulnerabilities or unintended behavior.

Recommendation

Apply workaround: Modify the loader to ignore Markdown links in SKILL.md files or use a non-link reference format for cross-skill pointers, as this approach is likely to be the most straightforward and effective solution to reduce startup noise and prevent misleading logs.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#configuration error#environment variable#network issue#logging issue#authentication issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING