Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: Plugin skill symlink triggers "Skipping escaped skill path" warning [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#78429•Fetched 2026-05-07 03:37:01
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
2
Author
Sun-0702Sun-0702
Participants
clawsweeper[bot]clawsweeper[bot]Sun-0702Sun-0702
Timeline (top)
labeled ×2closed ×1commented ×1

When the browser-automation extension is enabled, Gateway automatically creates a symlink under ~/.openclaw/plugin-skills/:

复制 ~/.openclaw/plugin-skills/browser-automation → ~/.nvm/versions/node/v24.15.0/lib/node_modules/openclaw/dist/extensions/browser/skills/browser-automation This symlink resolves to a path outside the plugin-skills/ root directory. The skill loader's path validation detects this as a path escape and logs a warning on every startup:

复制 [warn] [skills] Skipping escaped skill path outside its configured root. The skill itself still loads correctly (it's also registered as a built-in skill), so this is a cosmetic issue — but the warning is misleading and clutters the log.

Error Message

[warn] [skills] Skipping escaped skill path outside its configured root.

Root Cause

When the browser-automation extension is enabled, Gateway automatically creates a symlink under ~/.openclaw/plugin-skills/:

复制 ~/.openclaw/plugin-skills/browser-automation → ~/.nvm/versions/node/v24.15.0/lib/node_modules/openclaw/dist/extensions/browser/skills/browser-automation This symlink resolves to a path outside the plugin-skills/ root directory. The skill loader's path validation detects this as a path escape and logs a warning on every startup:

复制 [warn] [skills] Skipping escaped skill path outside its configured root. The skill itself still loads correctly (it's also registered as a built-in skill), so this is a cosmetic issue — but the warning is misleading and clutters the log.

RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

When the browser-automation extension is enabled, Gateway automatically creates a symlink under ~/.openclaw/plugin-skills/:

复制 ~/.openclaw/plugin-skills/browser-automation → ~/.nvm/versions/node/v24.15.0/lib/node_modules/openclaw/dist/extensions/browser/skills/browser-automation This symlink resolves to a path outside the plugin-skills/ root directory. The skill loader's path validation detects this as a path escape and logs a warning on every startup:

复制 [warn] [skills] Skipping escaped skill path outside its configured root. The skill itself still loads correctly (it's also registered as a built-in skill), so this is a cosmetic issue — but the warning is misleading and clutters the log.

Steps to reproduce

Install OpenClaw globally via npm Enable the browser-automation extension (or any extension that auto-creates a plugin-skills symlink pointing outside the plugin-skills root) Start / restart Gateway Observe the warning in the log dashboard

Expected behavior

Built-in extension plugin skills (like browser-automation) should either:

Be placed/resolved within the plugin-skills/ root so they pass path validation, or Be exempted from the path escape check when they originate from a trusted built-in extension path

Actual behavior

Built-in extension plugin skills (like browser-automation) should either:

Be placed/resolved within the plugin-skills/ root so they pass path validation, or Be exempted from the path escape check when they originate from a trusted built-in extension path

OpenClaw version

OpenClaw: 2026.5.5 (stable)

Operating system

OS: macOS 15.7.5 (x64)

Install method

No response

Model

GML

Provider / routing chain

openclaw -> zai

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Built-in extension plugin skills (like browser-automation) should either:

Be placed/resolved within the plugin-skills/ root so they pass path validation, or Be exempted from the path escape check when they originate from a trusted built-in extension path

#latency issue#model loading#dependency error#configuration error#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: Plugin skill symlink triggers "Skipping escaped skill path" warning [1 comments, 2 participants]