LobsterAI uninstall trusted a skill-controlled deletion directory

Removing an installed LobsterAI skill could direct recursive deletion outside that skill's managed directory. In issue 2793, the maintainer confirmed that the uninstall handler trusted an openclawSourceDir path from the skill's _meta.json file, which a downloaded package could supply itself.

The field was intended to remember where an OpenClaw-synced skill originated. The ordinary installation path copied a downloaded package into the managed skills directory, including any supplied metadata. Later, uninstall treated the stored path as permission to remove another directory with the application's privileges. The security boundary was therefore package-controlled lifecycle metadata becoming a deletion target. No malicious instruction in SKILL.md needed to persuade the model.

The disclosure includes a material correction to affected scope. The reporter's October 5 description treated the problem as main-branch-only using obsolete v0.2.x tags. On October 7 the maintainer explained that LobsterAI used date-based releases and that versions 2026.5.27 through 2026.9.23 were affected. That maintainer correction rules out presenting released users as unaffected.

The maintainer reports changing uninstall to remove only the skill's own managed directory and removing openclawSourceDir from the synchronization path. The change was merged for the 2026.9.24 release branch, with regression and end-to-end testing reported. Issue closure on October 12 and a merged branch still do not independently prove distribution of a fixed binary. The cited record establishes a reported repair and affected release range, while actual customer losses and the first verified distributed fix remain unknown.