-
-
Notifications
You must be signed in to change notification settings - Fork 79.1k
[Bug]: Non-workspace skills are inaccessible to the agent when sandbox is in workspaceAccess: "rw" mode #90410
Copy link
Copy link
Closed
Labels
P1High-priority user-facing bug, regression, or broken workflow.High-priority user-facing bug, regression, or broken workflow.bugSomething isn't workingSomething isn't workingclawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.regressionBehavior that previously worked and now failsBehavior that previously worked and now fails
Description
Metadata
Metadata
Assignees
Labels
P1High-priority user-facing bug, regression, or broken workflow.High-priority user-facing bug, regression, or broken workflow.bugSomething isn't workingSomething isn't workingclawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.regressionBehavior that previously worked and now failsBehavior that previously worked and now fails
Type
Fields
Give feedbackNo fields configured for issues without a type.
Bug type
Regression (worked before, now fails)
Beta release blocker
No
Summary
When the sandbox is configured with workspaceAccess: "rw", the agent inside the sandbox cannot read the SKILL.md files of managed skills (~/.openclaw/skills/) or bundled/plugin skills (/usr/lib/node_modules/openclaw/skills/, extensions/*/skills/). The sandbox has no access.
workspaceAccess: "rw" mode: Lacks an automatic visibility mechanism for non-workspace skills.
Steps to reproduce
Configure the sandbox with workspaceAccess: "rw".
Start a staff agent (which creates an independent workspace).
Have the agent use feishu-doc or any other managed/bundled skill.
Check the logs to see the "Path escapes sandbox root" error.
Expected behavior
When the sandbox is configured with workspaceAccess: "rw", the agent should still be able to access and read the system-level and managed skills provided in the system prompt. The environment should ensure these skill files are either mirrored into the workspace or correctly mapped within the sandbox boundary, allowing for multi-step tasks that rely on those skills.
Actual behavior
The agent fails to read the SKILL.md files for non-workspace skills. Any attempt to access paths outside the specific workspace directory (such as /usr/lib/node_modules/openclaw/... or ~/.openclaw/skills/...) is blocked by the path resolver, resulting in a "Path escapes sandbox root" error. This effectively breaks all core skills for agents running in rw mode unless those skills are manually copied into the workspace beforehand.
OpenClaw version
2026.6.1
Operating system
Ubuntu 24
Install method
npm
Model
chatgpt-5.5
Provider / routing chain
openclaw -> codex
Additional provider/model setup details
No response
Logs, screenshots, and evidence
Impact and severity
Builtin skills are fully broken with sandbox RW mode. Further, all users of builtin skills that need read/write access are completely broken in sandbox mode. Workspaceacces "none" is also broken due to a separate bug that prevents write access, so there's no workaround for this bug.
Additional information
A prior filing of this bug was mistakenly closed due to hallucination of a PR as an issue tracker, and that PR was mistakenly closed due to hallucination of a separate PR as resolving the bug (it did not resolve the bug).