Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Proposal]: Default tools.fs.workspaceOnly to true to prevent out-of-workspace file operations [2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#58947•Fetched 2026-04-08 02:30:54
View on GitHub
Comments
2
Participants
3
Timeline
3
Reactions
0
Author
cjg20sscjg20ss
Participants
11687841168784cjg20sscjg20ssLinux2010Linux2010
Timeline (top)
commented ×2labeled ×1

Restrict the agent's default file I/O access strictly to the workspace directory to ensure secure out-of-the-box behavior.

Root Cause

Restrict the agent's default file I/O access strictly to the workspace directory to ensure secure out-of-the-box behavior.

RAW_BUFFERClick to expand / collapse

Summary

Restrict the agent's default file I/O access strictly to the workspace directory to ensure secure out-of-the-box behavior.

Problem to solve

Current Behavior: Currently, when using the default tools.profile="coding", the tools.fs.workspaceOnly configuration implicitly defaults to false if left unconfigured.

Problem: This default behavior grants the agent's File I/O tools unrestricted read and write access to the host's entire file system. If an agent hallucinates or executes a poorly constructed command, it could accidentally (or maliciously) read, modify, or delete sensitive files outside the designated project workspace.

Benefits of the New Requirement: Changing the default to true will enforce a secure, sandboxed environment out-of-the-box. It guarantees that the agent cannot tamper with the host machine's external file system, providing users with immediate peace of mind and preventing accidental system damage without requiring manual configuration.

Proposed solution

Update the default fallback value of tools.fs.workspaceOnly from false to true globally.

Alternatives considered

No response

Impact

Affected users/systems/channels: All users initializing the agent with default configurations. Severity: High (Security & Data Integrity Risk). Unrestricted file system access by an autonomous agent can lead to severe system damage or data leaks. Frequency: Always. This vulnerability affects every new session where the user relies on the default settings without explicitly overriding them. Consequence: Users are currently exposed to unintended out-of-bounds file modifications by default. Security-conscious users are forced to manually add extra configurations to secure their environment. Changing this provides a "secure by default" posture.

Evidence/examples

No response

Additional information

Openclaw version: 2026.4.1 Operating System: Ubuntu 22.04.5 LTS

extent analysis

TL;DR

Update the default value of tools.fs.workspaceOnly to true to restrict the agent's file I/O access to the workspace directory.

Guidance

  • Verify the current value of tools.fs.workspaceOnly in your configuration to ensure it is not already set to true.
  • Update the default fallback value of tools.fs.workspaceOnly to true globally to enforce a secure, sandboxed environment.
  • Test the agent with the updated configuration to ensure it can only access files within the designated project workspace.
  • Consider reviewing existing user configurations to identify any instances where tools.fs.workspaceOnly may be explicitly set to false and update them accordingly.

Example

No code snippet is provided as the issue does not contain specific code examples.

Notes

This solution assumes that updating the tools.fs.workspaceOnly configuration value is sufficient to restrict the agent's file I/O access. However, additional testing and verification may be necessary to ensure the change does not introduce any unintended consequences.

Recommendation

Apply the workaround by updating the default value of tools.fs.workspaceOnly to true, as this change provides a "secure by default" posture and prevents potential security risks associated with unrestricted file system access.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#callback error#memory management#API rate limit#retriever error#indexing error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING