openclaw - ✅(Solved) Fix [Bug]: When uploading skills, files under the .git directory will be read [1 pull requests, 2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60879Fetched 2026-04-08 02:46:13
View on GitHub
Comments
2
Participants
2
Timeline
12
Reactions
0
Author
Timeline (top)
referenced ×4commented ×2cross-referenced ×2labeled ×2

When uploading skills, files under the .git directory will be read

Root Cause

When uploading skills, files under the .git directory will be read

PR fix notes

PR #61090: fix(skills): exclude .git and node_modules when copying skills to workspace

Description (problem / solution / changelog)

Closes #60879

Summary

  • Added a filter to the fsp.cp call in syncSkillsToWorkspace that excludes .git and node_modules directories when copying skill trees to the sandbox workspace.

Root Cause

syncSkillsToWorkspace in src/agents/skills/workspace.ts uses fsp.cp with recursive: true but no filter option, so the entire skill directory tree is copied verbatim, including .git (which can contain large binary pack files) and node_modules.

Other file-walking code in the repo (e.g. computeSkillFingerprint, walkDirWithLimit in the skill scanner, listCandidateSkillDirs) already skips dot-directories and node_modules, so this was the one path that was missing the exclusion.

Changes

src/agents/skills/workspace.ts - added a filter callback to fsp.cp that rejects entries named .git or node_modules.

Test Plan

  • npx vitest run src/agents/skills/ - 34/34 pass
  • No lint errors on touched files

Risks and Mitigations

  • The filter is conservative: it only skips .git and node_modules by basename, matching the patterns used by the rest of the skill file-walking code.
  • No user-facing skill data lives in .git or node_modules, so excluding them has no functional impact.

Joel Nishanth - offlyn.AI

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts (modified, +15/-0)
  • src/agents/skills/workspace.ts (modified, +4/-0)
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

When uploading skills, files under the .git directory will be read

Steps to reproduce

When uploading skills, files under the .git directory will be read

Expected behavior

When uploading skills, files under the .git directory will be read

Actual behavior

When uploading skills, files under the .git directory will be read

OpenClaw version

2026.3.13

Operating system

win11

Install method

npm

Model

mini

Provider / routing chain

openclaw

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

The issue can be mitigated by ensuring that the upload process excludes files under the .git directory.

Guidance

  • Review the upload functionality to identify why files under the .git directory are being read and modify it to exclude these files.
  • Verify that the upload process is correctly configured to ignore .git directories, which are typically excluded from uploads to prevent sensitive information exposure.
  • Consider implementing a filter or check in the upload code to explicitly skip files under the .git directory.
  • Check if there are any specific settings or configurations in the OpenClaw version 2026.3.13 or the npm installation that might be causing this behavior.

Notes

The provided information does not specify the exact cause of the issue, so these suggestions are based on general principles of handling .git directories during file uploads.

Recommendation

Apply workaround: Modify the upload process to exclude files under the .git directory to prevent unintended access to sensitive information.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

When uploading skills, files under the .git directory will be read

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: When uploading skills, files under the .git directory will be read [1 pull requests, 2 comments, 2 participants]