Security audit
Security checks for vulnerabilities and agentic risk
The skill has a reasonable config-protection purpose, but it installs or documents persistent background changes and rollback behavior with unsafe uninstall and incomplete platform support.
Review carefully before installing. The concept is useful, but this package should be fixed to include all referenced installer assets, require explicit consent before enabling background jobs, safely remove only its own cron entry, protect backup permissions, and make rollback behavior more precise and clearly disclosed.
scripts/install.sh:51Uninstall command deletes the user's entire crontab
scripts/guard.py:34Sensitive configuration backups are created without explicit restrictive permissions
scripts/guard.py:58Rollback restores an unrelated configuration file from an independently selected backup
scripts/health-check.sh:15Gateway health check treats HTTP error responses as healthy
scripts/install.sh:13Installers reference missing components and can leave a partial installation
scripts/install.sh:32Cron installation rewrites the entire user crontab using a broad substring filter
A second independent description-behavior mismatch reiterates unsupported claims about periodic Gateway health monitoring, auto-recovery, and Windows support. In a safety-oriented skill, overstating recovery guarantees is especially risky because the skill's entire purpose is to prevent system breakage after configuration edits.
A second independent description-behavior mismatch reiterates unsupported claims about periodic Gateway health monitoring, auto-recovery, and Windows support. In a safety-oriented skill, overstating recovery guarantees is especially risky because the skill's entire purpose is to prevent system breakage after configuration edits.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
schtasks /query /tn "OpenClaw"
schtasks /delete /tn "OpenClaw Config Guard" /f schtasks /delete /tn "OpenClaw Health Check" /f
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
schtasks /query /tn "OpenClaw"
schtasks /delete /tn "OpenClaw Config Guard" /f schtasks /delete /tn "OpenClaw Health Check" /f
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
schtasks /query /tn "OpenClaw"
schtasks /delete /tn "OpenClaw Config Guard" /f schtasks /delete /tn "OpenClaw Health Check" /f
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
schtasks /query /tn "OpenClaw"
schtasks /delete /tn "OpenClaw Config Guard" /f schtasks /delete /tn "OpenClaw Health Check" /f
The skill instructs users to run shell scripts and configuration-changing commands but does not declare any tool scope or permissions. That omission reduces transparency and reviewability, making it easier for a consuming agent or user to invoke file-writing and shell behaviors without clear upfront consent boundaries.
The skill promotes fully automatic rollback and recovery without clearly warning that user configuration changes may be overwritten. Automatic reversion of config state can cause loss of intended edits, confusion during troubleshooting, and repeated rollback loops if users are unaware of the mechanism.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
launchctl unload ~/Library/LaunchAgents/com.openclaw.config-guard.plist crontab -e # 删除 config-safety 那行
### Windows（命令提示符 / PowerShell）
This shell script performs a potentially destructive recovery action by invoking a rollback command when health checks fail. Although there are log messages, they do not clearly disclose the impact of the rollback ahead of time to a user, and there is no confirmation prompt or prominent warning comment explaining that the script may automatically revert state.
This finding identifies the installer section that deploys a launchd plist, which is part of establishing persistence. User-level launchd agents automatically restart or re-run code across sessions, which is security-sensitive in a skill because it extends code execution beyond the immediate install action.
cp "$HOME/.openclaw/skills/config-modification-safety/scripts/health-check.sh" "$WORK_DIR/"
chmod +x "$WORK_DIR/health-check.sh"
# 2. 部署 launchd plist（第一层守护）
echo "🚀 注册第一层守护（launchd WatchPaths）..."
PLIST_SRC="$HOME/.openclaw/skills/config-modification-safety/scripts/com.openclaw.config-guard.plist"
PLIST_DST="$HOME/Library/LaunchAgents/com.openclaw.config-guard.plist"
The manifest says the skill supports both macOS and Windows, but this installer only configures macOS-style mechanisms: a LaunchAgents plist under ~/Library/LaunchAgents and a crontab entry. There is no Windows installation path, service registration, or Task Scheduler logic here, so the described cross-platform support is not reflected in the actual code.
The script installs persistent execution via LaunchAgents and crontab, altering the user's startup behavior and scheduled tasks without an explicit consent prompt or a prominent warning before making those changes. Persistent autorun is security-sensitive because it survives the current session and can continue executing code from the skill directory, increasing blast radius if the installed scripts are modified later.
The use of a plist-backed LaunchAgent path contributes to session persistence. In this skill's context, that means configuration-monitoring code will continue to execute automatically, which becomes dangerous if the deployed scripts can be altered by other local processes or future agent actions.
# 2. 部署 launchd plist（第一层守护）
echo "🚀 注册第一层守护（launchd WatchPaths）..."
PLIST_SRC="$HOME/.openclaw/skills/config-modification-safety/scripts/com.openclaw.config-guard.plist"
PLIST_DST="$HOME/Library/LaunchAgents/com.openclaw.config-guard.plist"
# 替换路径占位符
The use of a plist-backed LaunchAgent path contributes to session persistence. In this skill's context, that means configuration-monitoring code will continue to execute automatically, which becomes dangerous if the deployed scripts can be altered by other local processes or future agent actions.
# 2. 部署 launchd plist（第一层守护）
echo "🚀 注册第一层守护（launchd WatchPaths）..."
PLIST_SRC="$HOME/.openclaw/skills/config-modification-safety/scripts/com.openclaw.config-guard.plist"
PLIST_DST="$HOME/Library/LaunchAgents/com.openclaw.config-guard.plist"
# 替换路径占位符
This line finalizes creation of the LaunchAgent plist, which is a standard persistence mechanism. In the agent-skill context, hidden or under-explained persistence is riskier because users may not expect background execution to survive the installation session.
# 2. 部署 launchd plist（第一层守护）
echo "🚀 注册第一层守护（launchd WatchPaths）..."
PLIST_SRC="$HOME/.openclaw/skills/config-modification-safety/scripts/com.openclaw.config-guard.plist"
PLIST_DST="$HOME/Library/LaunchAgents/com.openclaw.config-guard.plist"
# 替换路径占位符
sed "s|/Users/mingming|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
This line finalizes creation of the LaunchAgent plist, which is a standard persistence mechanism. In the agent-skill context, hidden or under-explained persistence is riskier because users may not expect background execution to survive the installation session.
# 2. 部署 launchd plist（第一层守护）
echo "🚀 注册第一层守护（launchd WatchPaths）..."
PLIST_SRC="$HOME/.openclaw/skills/config-modification-safety/scripts/com.openclaw.config-guard.plist"
PLIST_DST="$HOME/Library/LaunchAgents/com.openclaw.config-guard.plist"
# 替换路径占位符
sed "s|/Users/mingming|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
Calling launchctl load activates the LaunchAgent immediately, enabling automatic execution beyond the current shell session. Immediate activation of persistence increases risk because it can start running unattended without a separate review step by the user.
PLIST_DST="$HOME/Library/LaunchAgents/com.openclaw.config-guard.plist"
# 替换路径占位符
sed "s|/Users/mingming|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || echo " (可能已加载，跳过)"
# 3. 部署 cron 任务（第二层守护）
This line is part of the active launchd persistence flow and indicates the LaunchAgent is being enabled. In a security-sensitive review, automatic background execution is noteworthy because it creates a long-lived foothold for whatever code the agent references.
# 替换路径占位符
sed "s|/Users/mingming|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || echo " (可能已加载，跳过)"
# 3. 部署 cron 任务（第二层守护）
echo "⏰ 注册第二层守护（cron 健康巡检）..."
This line is part of the active launchd persistence flow and indicates the LaunchAgent is being enabled. In a security-sensitive review, automatic background execution is noteworthy because it creates a long-lived foothold for whatever code the agent references.
# 替换路径占位符
sed "s|/Users/mingming|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || echo " (可能已加载，跳过)"
# 3. 部署 cron 任务（第二层守护）
echo "⏰ 注册第二层守护（cron 健康巡检）..."
The installer writes a cron entry that executes every 5 minutes, creating persistent background execution. In the context of an agent skill, this is security-relevant because recurring execution can be abused if the referenced script or workspace is later tampered with, and the user may not realize ongoing code is being run.
CRON_LINE="*/5 * * * * $HOME/.openclaw/workspace/.lib/config-safety/health-check.sh >> $HOME/.openclaw/workspace/.lib/config-safety/health-check.log 2>&1"
# 读取现有 crontab，移除旧的任务（避免重复）
(crontab -l 2>/dev/null | grep -v "config-safety/health-check"; echo "$CRON_LINE") | crontab -
# 4. 创建初始备份
echo "💾 创建初始配置备份..."
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo " 查看守护状态：launchctl list | grep config-guard"
echo " 查看守护日志：tail -f $HOME/.openclaw/workspace/.lib/config-safety/guard.log"
echo " 手动回滚：python3 $HOME/.openclaw/workspace/.lib/config-safety/guard.py rollback"
echo " 卸载：launchctl unload $HOME/Library/LaunchAgents/com.openclaw.config-guard.plist && crontab -r"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo " 查看守护状态：launchctl list | grep config-guard"
echo " 查看守护日志：tail -f $HOME/.openclaw/workspace/.lib/config-safety/guard.log"
echo " 手动回滚：python3 $HOME/.openclaw/workspace/.lib/config-safety/guard.py rollback"
echo " 卸载：launchctl unload $HOME/Library/LaunchAgents/com.openclaw.config-guard.plist && crontab -r"
The module docstring presents this file as the 'first-layer' guard whose principle is listening for config changes, validating JSON syntax, and immediately rolling back on errors. In addition to rollback, the code also restarts the Gateway during rollback, which is a broader operational action not described in this file's stated behavior.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def restart_gateway():
"""重启 Gateway"""
log("重启 Gateway...")
result = subprocess.run(
["openclaw", "gateway", "restart"],
capture_output=True, text=True
)