CVE-2026-27485: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27485 is a UNIX symbolic link (symlink) following vulnerability in OpenClaw, a personal AI assistant, affecting the skills/skill-creator/scripts/package_skill.py local helper script used when authors package skills. In versions 2026.2.17 and below, the script followed symlinks while building .skill archives, potentially allowing unintended local files to be included in generated skill artifacts. The vulnerability was disclosed on February 20, 2026, and patched in version 2026.2.18. It carries a CVSS v3.1 base score of 4.4 (Medium) and a CVSS v4.0 base score of 4.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-61 (UNIX Symbolic Link Following) — the package_skill.py script used Python's Path.rglob("*") to walk skill directories without checking whether encountered paths were symlinks before adding them to the ZIP archive. If a skill directory contained a symlink pointing to a file outside the skill root (e.g., /etc/passwd or SSH keys), the script would resolve and include the symlink target's contents in the generated .skill archive. Exploitation requires local execution of the packaging script against attacker-controlled skill directory contents; the vulnerability is not reachable via OpenClaw's gateway or chat runtime paths. The fix adds an explicit file_path.is_symlink() check that aborts packaging with an error if any symlink is detected (GitHub Advisory, Fix Commit).

Successful exploitation can result in unintentional disclosure of sensitive local files from the developer's packaging machine — such as credentials, configuration files, SSH keys, or /etc/passwd — embedded within a distributed .skill archive. If the resulting archive is shared or published, recipients could extract and access those sensitive files. There is no impact on availability, and integrity impact is limited to the contents of the generated artifact rather than the host system directly (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is approximately 0.007% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to convince a developer to run the packaging script on attacker-controlled skill directory contents, making it a social engineering-dependent, local attack vector.

1. Prepare malicious skill directory: Create a valid-looking OpenClaw skill directory structure including a SKILL.md file and other required components to pass basic validation.
2. Plant symlinks: Inside the skill directory, create one or more symbolic links pointing to sensitive files outside the skill root — for example: ln -s /etc/passwd skill-dir/loot.txt or ln -s ~/.ssh/id_rsa skill-dir/config.
3. Deliver to target: Convince a skill developer or contributor to run the package_skill.py script against the crafted directory, e.g., by submitting it as a community skill contribution or sharing it via a repository.
4. Trigger packaging: The developer executes python package_skill.py /path/to/crafted-skill-dir, causing the script to traverse the directory and follow the symlinks, embedding the target file contents into the .skill ZIP archive.
5. Exfiltrate the archive: Obtain the generated .skill file (e.g., via the developer sharing it for review or publishing it to a skill marketplace), then extract it to access the embedded sensitive files (GitHub Advisory, Fix Commit).

• File System: Generated .skill archive files containing unexpected entries (e.g., files named passwd, id_rsa, .env, or other sensitive filenames not part of the skill's source); presence of symlinks within skill directories pointing outside the skill root.
• Logs: Output from package_skill.py that does NOT include the [ERROR] Symlinks are not allowed message on versions prior to 2026.2.18, despite symlinks being present in the skill directory.
• Archive Contents: .skill files (ZIP format) that, when inspected with unzip -l, contain files with paths or content inconsistent with the declared skill functionality (e.g., system file contents, credential material).

Upgrade OpenClaw to version 2026.2.18 or later, which rejects symlinks during skill packaging and aborts with an error if any symlink is detected (GitHub Advisory, Fix Commit). Until patching is complete, developers should avoid running package_skill.py on untrusted or externally sourced skill directories, and should manually inspect skill directories for symlinks (find skill-dir -type l) before packaging. Additionally, inspect generated .skill archives for unexpected file inclusions before distribution.