Bug Summary

When creating or scaffolding skills (via package_skill.py, manual creation, or skill-creator workflows), nothing prevents the skill directory from being created outside the canonical workspace/skills/ path. This leads to orphaned skill directories in locations like ~/trigger-trap-skill/ or ~/my-skill/ that:

1. Are not discovered by OpenClaw skill loading (which scans workspace/skills/)
2. Are invisible to workspace git tracking
3. Persist indefinitely with no audit or cleanup mechanism
4. Create confusion about which copy is authoritative when a skill also exists in workspace/skills/

Steps to Reproduce

1. Create a skill directory anywhere outside workspace/skills/ (e.g., ~/my-new-skill/ with a valid SKILL.md)
2. OpenClaw does not warn that the skill is in a non-canonical location
3. The skill is never loaded, never audited, and never cleaned up
4. If a copy also exists in workspace/skills/my-new-skill/, there is no detection of the duplicate

Expected Behavior

• Skill scaffolding tools (if any) should default output to workspace/skills/<name>/ and warn if the user specifies a non-canonical path
• openclaw skills list or a diagnostic command should detect skill-like directories (SKILL.md present) outside canonical paths and flag them as orphans
• Ideally, openclaw status or a startup diagnostic could warn: "Found SKILL.md at ~/trigger-trap-skill/ — this is outside the workspace skills path and will not be loaded"

Actual Behavior

No detection, no warning, no cleanup. The orphaned directory sits indefinitely. In our case, ~/trigger-trap-skill/ existed for days before being noticed during a manual audit.

Environment

• OpenClaw version: latest (npm)
• OS: macOS (arm64)

Suggested Fix

1. Add an orphan-skill detection pass to openclaw skills list --check or openclaw status that scans ~/ (depth 1-2) for directories containing SKILL.md outside known skill paths
2. If OpenClaw provides a skill scaffold/create command, default the output path to workspace/skills/<name>/ and require an explicit flag to override
3. Consider a diagnostic warning at gateway startup if skill-like directories are found in non-canonical locations