PR #60155: fix(security): align audit symlink_escape boundary with skill loader

• Repository: openclaw/openclaw
• Author: menhguin
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/60155

Description (problem / solution / changelog)

Problem

The skills.workspace.symlink_escape audit probe checks whether workspace skill realpaths escape the workspace root, but the skill loader (resolveContainedSkillPath) checks whether they escape the skills directory root (workspace/skills/). This creates a gap where symlinks that resolve inside the workspace but outside the skills directory pass the audit but are silently rejected at load time.

Example: workspace/skills/my-skill -> ../shared/skills/my-skill resolves to workspace/shared/skills/my-skill — inside the workspace root (audit passes ✅) but outside workspace/skills/ (loader rejects ❌).

Impact

We had 10 symlinked skills silently invisible for nearly a month. The daily-review cron skill stopped working reliably when v2026.3.7 shipped the loader enforcement — but openclaw security audit never flagged it. The model compensated by discovering the skill file through manual filesystem search ~80% of the time, masking the issue.

Fix

Align the audit probe boundary with the loader: check against the skills directory root, not the workspace root. One-line logic change + updated finding messages + test for the gap case.

Changes

• audit-extra.async.ts: resolve skillsDir (workspace/skills) instead of workspacePath, use it as the containment boundary
• audit.test.ts: add test case for symlink inside workspace but outside skills dir
• Updated finding title/detail/remediation to reference "skills directory" instead of "workspace root"
• Added skills.load.extraDirs mention in remediation text

CI Note

Windows test failures in task-owner-access.test.ts are pre-existing timeouts, unrelated to this change.

Closes #60145

Changed files

• src/security/audit-extra.async.ts (modified, +7/-5)
• src/security/audit.test.ts (modified, +30/-1)