The vulnerability resides in OpenClaw’s packaging helper script, which, in versions 2026.2.17 and earlier, follows symbolic links when assembling skill archives. An attacker who controls the skill source directory can create a crafted structure that points to files outside the intended root. When the script runs locally, it will include those external files in the exported .skill package, allowing the attacker to exfiltrate local files from the packaging machine. The flaw is a classic path traversal issue and does not by itself provide remote code execution or cross‑site scripting capabilities.

OpenClaw personal AI assistant, any installation running the openclaw software package before version 2026.2.18. The vulnerability affects the internal packaging tool used by skill authors, not the user-facing runtime.

The CVSS score of 4.6 indicates moderate severity. Exploitation requires local execution of the packaging script with attacker‑controlled skill content, so the attack surface is limited to insiders or compromised build environments. The EPSS score of less than 1% reflects a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Since the flaw is confined to local file inclusion, it poses no immediate threat to end users but can enable information disclosure from the packaging host.