fix(security): disable auto-execution of workspace plugins without consent by coygeek · Pull Request #11035 · openclaw/openclaw

coygeek · 2026-02-07T09:23:52Z

Fix Summary

This PR fixes a workspace-plugin auto-execution security issue by requiring explicit opt-in before non-bundled plugins are enabled.

Scope in this PR

Default non-bundled plugins to disabled in resolveEnableState().
Add a discovery warning when workspace plugins are found.
Add a loader defense-in-depth check that blocks origin === "workspace" plugins unless plugins.entries.<id>.enabled: true is set.

This means a cloned repo's .openclaw/extensions content will not execute unless explicitly enabled.

Issue Linkage

Fixes #11031

Security Snapshot

Security scoring details were not present in the original PR body.

Implementation Details

Files Changed

src/agents/session-tool-result-guard.tool-result-persist-hook.test.ts (+4/-0)
src/plugins/config-state.ts (+1/-1)
src/plugins/discovery.ts (+8/-0)
src/plugins/loader.test.ts (+13/-0)
src/plugins/loader.ts (+23/-0)
src/plugins/tools.optional.test.ts (+18/-0)

Technical Analysis

This PR fixes a workspace-plugin auto-execution security issue by requiring explicit opt-in before non-bundled plugins are enabled.

Validation Evidence

Command: resolveEnableState()
Status: passed

Risk and Compatibility

non-breaking; compatibility impact was not explicitly documented in the original PR body.

AI-Assisted Disclosure

AI-assisted: unknown
Model: Unknown

Greptile Overview

Greptile Summary

_{1 file reviewed, 1 comment} _{Edit Code Review Agent Settings | Greptile}

Confidence Score: N/A

Restored by toolkit audit from existing PR thread signals.

greptile-apps

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-07T09:24:55Z

src/plugins/discovery.ts

+      if (candidates.length > prevCount) {
+        diagnostics.push({
+          level: "warn",
+          message: `Workspace plugins discovered at ${dir} — workspace plugins are not auto-enabled for security. Use 'openclaw plugin enable <id>' to enable.`,
+          source: dir,


Incorrect enable command

The warning message tells users to run openclaw plugin enable <id>, but the CLI command is openclaw plugins enable <id> (plural) in src/cli/plugins-cli.ts:22-46. As written, the suggested command will fail and makes it harder to actually opt in to a discovered workspace plugin.

Suggested change

if (candidates.length > prevCount) {

diagnostics.push({

level: "warn",

message: `Workspace plugins discovered at ${dir} — workspace plugins are not auto-enabled for security. Use 'openclaw plugin enable <id>' to enable.`,

source: dir,

message: `Workspace plugins discovered at ${dir} — workspace plugins are not auto-enabled for security. Use 'openclaw plugins enable <id>' to enable.`,

Prompt To Fix With AI

This is a comment left during a code review. Path: src/plugins/discovery.ts Line: 341:345 Comment: **Incorrect enable command** The warning message tells users to run `openclaw plugin enable <id>`, but the CLI command is `openclaw plugins enable <id>` (plural) in `src/cli/plugins-cli.ts:22-46`. As written, the suggested command will fail and makes it harder to actually opt in to a discovered workspace plugin. ```suggestion message: `Workspace plugins discovered at ${dir} — workspace plugins are not auto-enabled for security. Use 'openclaw plugins enable <id>' to enable.`, ``` How can I resolve this? If you propose a fix, please make it concise.

tyler6204 · 2026-02-07T13:04:24Z

Heads up: #11093 just merged (commit: 1007d71) and overlaps with this PR. You may need to rebase and rework to avoid conflicts. If the remaining scope here is fully covered by the merged PR, consider closing this.

…nsent Workspace plugins from .openclaw/extensions/ in cloned repositories were auto-loaded and executed without user consent, enabling arbitrary code execution (CVSS 9.6). This change: 1. Defaults non-bundled plugins to disabled in resolveEnableState() 2. Adds warning diagnostics when workspace plugins are discovered 3. Adds defense-in-depth pre-load check in the loader that blocks workspace plugins unless explicitly enabled via config Users must now opt in via plugins.entries.<id>.enabled: true or 'openclaw plugin enable <id>' to run workspace plugins. Co-Authored-By: Claude Opus 4.6 <[email protected]>

Update the workspace-plugin warning to use the correct CLI command\n('openclaw plugins enable <id>').\n\nAdjust plugin-related tests to explicitly set\nplugins.entries.<id>.enabled=true where plugin loading is expected,\nmatching the security hardening behavior that non-bundled plugins are\nnot enabled by default.

coygeek · 2026-02-08T00:01:01Z

Correction (previous comment formatting got mangled by shell interpolation):

Rebased onto latest main (base now 9271fcb3d, including #11093 / 1007d71f).

Follow-up changes in this push:

Fixed reviewer nit: warning now uses openclaw plugins enable <id>.
Updated plugin tests to reflect explicit opt-in behavior for non-bundled plugins by setting plugins.entries.<id>.enabled: true where loading is expected.

Local verification on this branch:

pnpm build
pnpm lint
pnpm test

All passed locally.

coygeek · 2026-02-08T00:09:00Z

Maintainer note for clarity after rebase:

The large 601583e...0f0c061 commit-to-commit compare is expected rebase noise (it includes intervening main history).
The actual PR diff vs current main is only 6 files / 2 commits and is limited to plugin opt-in hardening + related test updates.
Correct compare view: main...coygeek:fix/sa02-workspace-extensions

I also updated the PR body to match the implemented scope precisely.

coygeek · 2026-02-16T05:31:52Z

Cleanup note for traceability:

Linked issue #11031 was closed by maintainer as duplicate of #11030.
Keeping discussion/work tracking under canonical issue #11030 (linked issue closed as duplicate; canonical issue remains open).

Closing this PR to align with duplicate routing. If maintainers want this exact patch revived, I can reopen or submit a retargeted PR.

greptile-apps bot reviewed Feb 7, 2026

View reviewed changes

This was referenced Feb 7, 2026

[Bug]: oxlint preserve-caught-error violation in memory-lancedb blocks all PR CI #11060

Closed

fix(lint): preserve caught error in memory-lancedb loadLanceDB #11061

Closed

coygeek and others added 2 commits February 7, 2026 15:47

coygeek force-pushed the fix/sa02-workspace-extensions branch from 601583e to 0f0c061 Compare February 8, 2026 00:00

openclaw-barnacle bot added the agents Agent runtime and tooling label Feb 8, 2026

thewilloftheshadow force-pushed the main branch from bfc1ccb to f92900f Compare February 15, 2026 18:46

coygeek closed this Feb 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security): disable auto-execution of workspace plugins without consent#11035

fix(security): disable auto-execution of workspace plugins without consent#11035
coygeek wants to merge 2 commits intoopenclaw:mainfrom
coygeek:fix/sa02-workspace-extensions

coygeek commented Feb 7, 2026 •

edited

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 7, 2026

Uh oh!

tyler6204 commented Feb 7, 2026

Uh oh!

coygeek commented Feb 8, 2026

Uh oh!

coygeek commented Feb 8, 2026

Uh oh!

coygeek commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

coygeek commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fix Summary

Scope in this PR

Issue Linkage

Security Snapshot

Implementation Details

Files Changed

Technical Analysis

Validation Evidence

Risk and Compatibility

AI-Assisted Disclosure

Greptile Overview

Greptile Summary

Confidence Score: N/A

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

tyler6204 commented Feb 7, 2026

Uh oh!

coygeek commented Feb 8, 2026

Uh oh!

coygeek commented Feb 8, 2026

Uh oh!

coygeek commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coygeek commented Feb 7, 2026 •

edited

Loading