Greptile Summary

This PR fixes a boundary mismatch in collectWorkspaceSkillSymlinkEscapeFindings: the audit probe now checks realpaths against the skills/ subdirectory realpath instead of the workspace root, matching the boundary enforced by the skill loader (resolveContainedSkillPath in workspace.ts). A new test covers the previously-silent "inside workspace but outside skills dir" case. The only gap is that the remediation string on line 933 still says "workspace root" while the title and detail have been updated to say "skills directory".

Confidence Score: 5/5

Safe to merge; the logic fix is correct and well-tested, with only a minor remediation string inconsistency.

All remaining findings are P2. The core boundary alignment fix is correct and directly matches the loader's behavior. The new test case validates the previously uncaught scenario.

src/security/audit-extra.async.ts line 933 — remediation text should say "skills directory" not "workspace root".

This is a comment left during a code review.
Path: src/security/audit-extra.async.ts
Line: 932-933

Comment:
**Remediation text still references workspace root**

The `title` and `detail` were correctly updated to say "skills directory", but the `remediation` string still says "inside the workspace root". A symlink that resolves inside the workspace but outside `skills/` is exactly the new case being caught, so a user following this remediation ("keep inside workspace root") would think they've fixed the issue when they haven't.

```suggestion
    remediation:
      "Keep workspace skills inside the skills directory (replace symlinked escapes with real in-workspace files), or move trusted shared skills to managed/bundled skill locations.",
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(security): align audit symlink_escap..." | Re-trigger Greptile}

Closing this as duplicate or superseded after Codex automated review.

PR #60513 is a duplicate of the same remaining audit/loader boundary fix already tracked by open PR #60155. Current main still has the mismatch, so this is not implemented, but cleanup should keep one canonical PR rather than two parallel copies of the same fix.

Best possible solution:

Close #60513 as duplicate/superseded and continue the fix in #60155. The eventual landed change should make the audit check compare against the resolved workspace skills directory, update finding/docs wording from workspace root to skills directory, and add the inside-workspace/outside-skills regression test.

What I checked:

• Canonical PR already tracks the same fix: Provided related-item context and the local ClawSweeper report show open PR fix(security): align audit symlink_escape boundary with skill loader #60155 has the same title and same audit/loader boundary fix, and issue [Bug]: security audit symlink_escape probe uses wrong boundary (workspace root vs skills directory) #60145 was already closed as an exact duplicate of the remaining work tracked by fix(security): align audit symlink_escape boundary with skill loader #60155. git ls-remote also confirms refs/pull/60155/head exists at 0daf503 while this PR head exists at bf84e3a. (0daf50308af1)
• Current audit still uses workspace-root boundary: On current main, collectWorkspaceSkillSymlinkEscapeFindings resolves workspaceRealPath and treats skill realpaths inside that workspace root as safe; the finding title/detail/remediation still describe escaping the workspace root. (src/security/audit-workspace-skills.ts:129, e29d3516bf05)
• Skill loader enforces the skills-root boundary: The loader resolves contained skill paths against the configured root realpath, then workspace skill loading checks child skill directories and SKILL.md files against the resolved skills base directory. This can reject symlinks the audit currently accepts. (src/agents/skills/workspace.ts:268, e29d3516bf05)
• Current tests do not cover the inside-workspace/outside-skills case: The current workspace symlink audit test covers a symlink to a path outside the workspace and a normal file inside workspace/skills, but it does not include the PR's regression case where the realpath stays inside the workspace while escaping workspace/skills. (src/security/audit-workspace-skill-escape.test.ts:21, e29d3516bf05)
• Docs still reflect current workspace-root behavior: The security audit checks table still describes skills.workspace.symlink_escape as detecting workspace skills that resolve outside the workspace root, not outside the skills directory. Public docs: docs/gateway/security/audit-checks.md. (docs/gateway/security/audit-checks.md:98, e29d3516bf05)
• PR fix(security): align audit symlink_escape boundary with skill loader #60513 discussion supports the same narrow fix, not a separate product path: The PR body describes the same boundary mismatch, relates it to [Bug]: Symbolic links for skill directories under ~/.openclaw/skills/ are not consistently resolved #49408, and says it replaces closed PR fix(security): align audit symlink_escape boundary with skill loader #60144. The Greptile comment agreed the logic/test direction was correct while noting a minor remediation-string inconsistency, so the useful work should be consolidated into the canonical PR rather than tracked separately here. (bf84e3a065d3)

So I’m closing this here and keeping the remaining discussion on the canonical linked item.

Codex Review notes: model gpt-5.5, reasoning high; reviewed against e29d3516bf05.