LobsterAI security report: untrusted _meta.json path controls skill uninstall

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsLobsterAI uninstall trusted a skill-controlled deletion directory: LobsterAI maintainers confirmed that an installed skill could supply openclawSourceDir inside _meta.json, which was used as a recursive deletion target during uninstall.

  Issue #2793, maintainer confirmation and explanation of _meta.json-controlled delete.

• supportsLobsterAI uninstall trusted a skill-controlled deletion directory: Maintainers identified affected date-version releases from 2026.5.27 through 2026.9.23 and a merged correction planned for 2026.9.24; a merged commit alone does not prove a fixed release was distributed.

  Issue #2793, maintainer October 7 response and October 12 activity.

• supportsLobsterAI uninstall trusted a skill-controlled deletion directory: The initial October 5 report characterized the flaw as main-branch-only based on obsolete v0.2.x tags. On October 7, the maintainer explicitly corrected that statement: date-based releases 2026.5.27 through 2026.9.23 were affected.

  Issue description, Affected versions; fisherdaddy comment dated October 7, 2026, Affected versions.