Security audit

windows-healing-gateway

Security checks for vulnerabilities and agentic risk

Overview

This Windows self-healing skill is purpose-aligned in concept, but it exposes persistent PowerShell scheduled tasks and repair commands whose executable scripts are missing from the reviewed package.

Install only after the publisher provides the missing PowerShell scripts, documents exactly what deploy and repair change, adds an uninstall/rollback path, requires explicit confirmation for persistence and destructive repair actions, and explains what logs or metadata are sent to AI providers or Telegram. Review the scheduled tasks carefully before registering them.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: scripts/OpenClaw-Gateway-AutoStart.xml:8
Finding: Persistent PowerShell execution through boot, logon, and registration-triggered scheduled tasks
Content: View full analysis
true true ... powershell.exe -ExecutionPolicy Bypass -File "%USERPROFILE%\.openclaw\scripts\openclaw-gateway-starter.ps1" %USERPROFILE%\.openclaw ``` `scripts/OpenClaw-Monitor-Service.xml:8-16,38-44`: ```xml true PT30S true PT10S ... powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "%USERPROFILE%\.openclaw\scripts\openclaw-monitor.ps1" %USERPROFILE%\.openclaw ``` ### Technical Analysis The task definitions establish cross-session execution at system boot, user logon, and task registration. This behavior is directly related to the declared continuous monitoring and self-healing functionality, but it remains a system-persistence mechanism and should require explicit user consent. Both tasks invoke PowerShell with `-ExecutionPolicy Bypass`. The monitor also uses `-WindowStyle Hidden`, reducing user visibility into its execution. Although both XML files specify `RunLevel` as `LeastPrivilege`, these options weaken defense-in-depth and allow any code placed at the referenced script paths t ...[truncated 1906 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/OpenClaw-Monitor-Service.xml:38
Finding: Scheduled tasks and declared tools reference absent, mutable PowerShell payloads
Content: View full analysis
powershell.exe -ExecutionPolicy Bypass -File "%USERPROFILE%\.openclaw\scripts\openclaw-gateway-starter.ps1" %USERPROFILE%\.openclaw ``` `scripts/OpenClaw-Monitor-Service.xml:38-44`: ```xml powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "%USERPROFILE%\.openclaw\scripts\openclaw-monitor.ps1" %USERPROFILE%\.openclaw ``` `skill.json:22-36`: ```json "tools": { "healing.deploy": { "description": "Deploy the healing system", "command": "powershell -ExecutionPolicy Bypass -File scripts/deploy-windows-healing.ps1" }, "healing.status": { "description": "Check healing system status", "command": "schtasks /Query /TN \"OpenClaw\\*\" /FO LIST" }, "healing.repair": { "description": "Trigger manual repair", "command": "powershell -ExecutionPolicy Bypass -File scripts/openclaw-fix.ps1" }, "healing.logs": { "description": "View healing logs", "command": "Get-Content ~/.openclaw/logs/monitor.log -Tail 20" } } ``` `docs/UPLOAD.md:7-15` describes files that are expected to exist: ```text windows-healing-gateway/ ├── scripts/ │ ├── openclaw-fix.ps1 │ ├── openclaw-monitor.ps1 │ ├── openclaw-gateway-starter.ps1 │ ├── OpenClaw-Gateway-AutoStart.xml │ ├── OpenClaw-Monitor-Service.xml │ └── deploy-windows-healing.ps1 ``` Ho ...[truncated 2839 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises automated repair actions including killing processes, disabling plugins, and restarting services, but it does not clearly warn users that these actions may be disruptive or destructive. In a Windows self-healing/automation skill, operators may deploy this expecting low-risk monitoring, and the missing disclosure increases the chance of unintended service interruption or loss of functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes AI diagnosis and Telegram alerts using API credentials, but it does not warn that logs, crash details, or other system metadata may be transmitted to external services. In this skill context, automated health diagnostics likely involve operational data from the host, so the lack of transparency can lead to unintended disclosure of sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly advertises continuous monitoring, automatic repair, and Telegram alerting, but the documentation does not clearly warn users that it may make autonomous system changes and transmit operational data off-host. In a security-sensitive Windows automation skill, lack of explicit disclosure reduces informed consent and can lead users to deploy behavior that alters services, scheduled tasks, or sends potentially sensitive logs and metadata externally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The scheduled task persists across logon and boot and launches PowerShell with '-ExecutionPolicy Bypass', which disables an important policy safeguard and makes it easier to run unsigned or tampered scripts from a user-writable path under %USERPROFILE%. In this context, any attacker or malware able to modify '%USERPROFILE%.openclaw\scripts\openclaw-gateway-starter.ps1' can gain reliable execution at startup, turning this task into a persistence mechanism.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The scheduled task launches PowerShell with ExecutionPolicy Bypass and WindowStyle Hidden from a user-writable path under %USERPROFILE%, while the task description presents it as simple crash monitoring. This combination reduces visibility, weakens built-in script execution safeguards, and creates an opportunity for unauthorized or modified scripts in that location to run automatically at boot and registration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest exposes deployment and repair tools that execute PowerShell scripts and scheduled-task queries with very broad descriptions and no stated preconditions, scope limits, or confirmation requirements. In an agent setting, vague tool semantics increase the chance of unsafe invocation of system-modifying operations, especially because the commands imply installation, repair, and persistence-related changes on Windows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest advertises 'deploy' and 'repair' commands that likely modify the host through PowerShell scripts, but it does not warn users that these actions can change scheduled tasks, persistence, monitoring, or system configuration. This omission is risky because an agent or user may invoke them without understanding their side effects, leading to unauthorized or unexpected host modifications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file presents core descriptive content in both English and Chinese, but it does not explain whether the skill is intentionally bilingual or offer a language/locale choice. Under the language policy, forcing or assuming a language/locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The task description claims it starts on user logon, but the configuration also includes a BootTrigger, creating broader execution than implied. This mismatch reduces transparency and can conceal persistence behavior from reviewers or users, increasing risk when combined with a startup script launched by PowerShell.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.