Gateway Safety

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:22 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent gateway-safety purpose, but its shell script has material safety and command-injection weaknesses around sensitive gateway configuration changes.

Review before installing. The skill is not showing deception or exfiltration, but it controls sensitive OpenClaw gateway configuration and its safety script needs hardening: validate numeric inputs, check every copy/restart result, enforce GATEWAY_LOCKOUT in the script, and document who can clear lockout state.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-gateway-update.sh:8

Finding

Command Injection Through Unvalidated Timeout Arithmetic

Content

View full analysis

/dev/null) if echo "$STATUS" | grep -q "RPC probe: ok"; then log "Gateway is back online and healthy (attempt $i)." SUCCESS=1 break fi sleep 1 done ``` ### Technical Analysis The second command-line argument is accepted without validating that it is a bounded decimal integer. It is subsequently inserted into a Bash arithmetic expression. Bash arithmetic expressions may recursively interpret variable contents as arithmetic syntax. Specially constructed expressions, including expressions containing array subscripts and command substitutions, can cause commands to be evaluated. Even when command execution is not achieved, negative, malformed, or extremely large values can bypass the intended health-check behavior or make the script run for an excessive period. The script modifies gateway configuration and restarts a service, making execution in its process context security-sensitive. ### Attack Path 1. An attacker or compromised automation invokes the script and controls its second argument. 2. The attacker supplies an arithmetic expression instead of a decimal timeout, such as an expression using an array subscript with command substitution. 3. The value is stored unchanged in `TIMEOUT`. 4. Bash evaluates the value when processing `((i=1; i<=$TIMEOUT; i++))`. 5. The embedded expression executes with the operating-system privileges of the account running the script. Alternatively, an extremely large integer can keep the polling loop active for an excessive duration. ### Impact Assessment Successful exploitation can execute arbitrary shell commands as the user running the Skill. That account already has a ...[truncated 398 chars]

Remediation

View remediation

300 )); then log "Error: Timeout must be an integer between 1 and 300 seconds." exit 1 fi TIMEOUT=$((10#$TIMEOUT)) ``` Use the validated numeric variable without another parameter expansion inside the arithmetic expression: ```bash for ((i = 1; i <= TIMEOUT; i++)); do # Health check done ``` Set a conservative upper bound appropriate for gateway startup so that callers cannot cause an unreasonably long execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/safe-gateway-update.sh:72

Finding

Command Injection Through Unvalidated Failure Counter State

Content

View full analysis

/dev/null || echo 0) COUNT=$((COUNT + 1)) echo "$COUNT" > "$COUNT_FILE" ``` ### Technical Analysis The script reads the contents of `~/.openclaw/config_failure_count` and evaluates those contents as a Bash arithmetic expression without first confirming that they contain only decimal digits. Bash arithmetic evaluation can interpret more than integer literals. Crafted input can contain arithmetic syntax that triggers evaluation of array subscripts or command substitutions. Malformed content can also terminate the rollback workflow before the lockout is established. The counter is persistent mutable state. Its security depends on the ownership and permissions of the file and every parent directory, but the script does not verify those properties or reject symbolic links. ### Attack Path 1. An attacker gains the ability to create, replace, or modify `~/.openclaw/config_failure_count`, such as through overly permissive file or directory permissions or another process writing unsafe state. 2. The attacker places a crafted arithmetic expression in the file. 3. A gateway update fails its health check and enters the rollback branch. 4. The script reads the attacker-controlled expression into `COUNT`. 5. `COUNT=$((COUNT + 1))` evaluates that expression in the script process. 6. Any resulting command executes as the user running the gateway update script. A malformed value can instead disrupt counter processing, preventing reliable lockout creation. ### Impact Assessment Exploitation can execute commands with the privileges of the script’s operating-system account. It can also corrupt the anti-loop state and interfere with rollback or lockout processing. The practical explo ...[truncated 152 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-gateway-update.sh:39

Finding

Unchecked Backup, Configuration, Restart, and Rollback Operations Cause Fail-Open Behavior

Content

View full analysis

/dev/null || echo 0) COUNT=$((COUNT + 1)) echo "$COUNT" > "$COUNT_FILE" log "Restarting gateway with original config (Failure #$COUNT)..." openclaw gateway restart ``` ### Technical Analysis The script does not check the exit status of the operations that implement its core safety guarantees: - Copying the current configuration to the backup - Applying the replacement configuration - Restarting the gateway - Restoring the backup - Restarting the gateway after rollback The script also does not enable a controlled fail-fast mode or provide explicit error branches for these commands. Consequently, it may continue after an operation fails. For example, if the initial restart fails while an existing gateway instance remains healthy, the later status probe may report `RPC probe: ok` for the old process. The script can then report success and overwrite `openclaw.json.known-good`, even though the requested configuration was never activated. Conversely, if backup creation or restoration fails, rollback may not restore the original configuration. ### Attack Path One representative failure or exploitation path is: 1. The backup copy fails because of permissions, storage exhaustion, a missing source file, or an unsafe filesystem object. 2. The script ignores that failure and attempts to apply the new configuration. 3. The restart command fails, or the o ...[truncated 1014 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/safe-gateway-update.sh:80

Finding

Anti-Loop Lockout Is Documented but Not Enforced by the Script

Content

View full analysis

"$HOME/.openclaw/GATEWAY_LOCKOUT" fi ``` There is no corresponding startup check for `~/.openclaw/GATEWAY_LOCKOUT`. ### Technical Analysis The lockout policy is enforced only through agent instructions, not by the executable safety boundary. Although the script creates a marker after three failures, a direct invocation or automation process can run the script again without checking the marker. The log message says the process is “STOPPING,” but the marker only affects behavior if every caller independently follows the documentation. This creates a discrepancy between the stated control and actual execution. ### Attack Path 1. Three consecutive gateway updates fail. 2. The script creates `~/.openclaw/GATEWAY_LOCKOUT`. 3. A caller, automation loop, or compromised agent invokes the script again. 4. The script never checks for the marker. 5. It backs up and replaces the configuration and restarts the gateway again. 6. Repeated attempts can continue despite the intended lockout. ### Impact Assessment The missing enforcement permits repeated gateway reconfiguration and res ...[truncated 355 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Core Rules

1. **Mandatory Script Use**: Never edit `~/.openclaw/openclaw.json` directly. Always use the provided `safe-gateway-update.sh` script.
2. **Anti-Loop Policy**: If the script fails 3 times consecutively, it will create a `GATEWAY_LOCKOUT` file. If this file exists, **STOP ALL OPERATIONS** and wait for Kevin. Do not attempt to bypass the lockout.
3. **Backup Awareness**: The script maintains its own backups, but for critical changes, manually verify `~/.openclaw/openclaw.json.known-good` is up to date.

## Usage