Security audit

三只虾协作系统

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent task-collaboration automation, but it enables persistent background monitoring and can send task details to hard-coded or unvalidated Feishu destinations.

Review this skill carefully before installing. It is tailored to a specific local account and Feishu recipient, and it can create persistent background jobs that keep monitoring workspace files after setup. Replace hard-coded paths and recipients, inspect or supply the missing plist files yourself, disable automatic external notifications unless intended, and avoid running the queue reset commands unless you have a verified backup.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T06 · System Persistence

Error

Location: install.sh:48
Finding: Persistent LaunchAgent and Cron Registration Executes Mutable Workspace Scripts<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:48-67`; `scripts/setup-heartbeat.sh:13-40`; `docs/shrimp-heartbeat-config.md:39-114` **Vulnerability Type**: Persistent scheduled execution from a mutable user workspace **Risk Level**: High ### Complete Code Snippet From `install.sh`: ```bash LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents" # Copy configuration files cp "scripts/com.openclaw.heartbeat.plist" "$LAUNCH_AGENTS_DIR/" cp "scripts/com.openclaw.fswatch.plist" "$LAUNCH_AGENTS_DIR/" # Unload existing configurations if launchctl list | grep -q "com.openclaw.heartbeat"; then launchctl unload "$LAUNCH_AGENTS_DIR/com.openclaw.heartbeat.plist" 2>/dev/null || true fi if launchctl list | grep -q "com.openclaw.fswatch"; then launchctl unload "$LAUNCH_AGENTS_DIR/com.openclaw.fswatch.plist" 2>/dev/null || true fi # Load new configurations launchctl load "$LAUNCH_AGENTS_DIR/com.openclaw.heartbeat.plist" launchctl load "$LAUNCH_AGENTS_DIR/com.openclaw.fswatch.plist" ``` From `docs/shrimp-heartbeat-config.md`: ```xml <key>ProgramArguments</key> <array> <string>/Users/zhangyang/.openclaw/workspace/scripts/heartbeat-check.sh</string> </array> <key>StartCalendarInterval</key> <array> <dict><key>Hour</key><integer>8</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>9</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>10</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>11</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>12</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>13</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>14</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>15</integer><key>Minute</key><integer>0</integer></dict> <dict><key>Hour</key><integer>16</in ...[truncated 2519 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make persistent service installation an explicit opt-in step and display the full service definition before registration. 2. Prefer OpenClaw's built-in scheduling mechanism when available. 3. Install scripts into an immutable, package-owned directory rather than a general mutable workspace. 4. Verify script ownership, restrictive permissions, and a recorded cryptographic hash before service loading. 5. Generate portable paths from the authenticated user's home directory instead of using `/Users/zhangyang`. 6. Include the actual plist files in the reviewed package and validate them with `plutil`. 7. Provide an uninstall script that unloads and deletes both LaunchAgents, removes cron entries, and optionally removes generated logs. 8. Prevent simultaneous cron and LaunchAgent registration. 9. Use modern `launchctl bootstrap` and `bootout` operations with a per-user GUI domain where supported. ]]>

T02 · Agent Memory Poisoning

Warning

Location: docs/shrimp-collaboration-protocol.md:24
Finding: Shared Task and Document Content Can Influence Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `docs/shrimp-collaboration-protocol.md:24-40`, `docs/shrimp-collaboration-protocol.md:79-96`, `docs/shrimp-collaboration-protocol.md:151-156` **Vulnerability Type**: Unvalidated shared content incorporated into durable agent state **Risk Level**: Medium ### Complete Code Snippet ```markdown #### Quick check (hourly) 1. Read tasks/queue.md 2. Check whether any [pending] tasks are assigned to itself 3. If present → claim and execute 4. If absent → reply HEARTBEAT_OK ``` ```markdown #### Full synchronization (daily at 12:00) 1. Read MEMORY.md 2. Read the responsibility matrix 3. Update its own status in tasks/queue.md 4. Check the status of other agents 5. Initiate a collaboration request if needed ``` ```markdown #### Daily summary (daily at 18:00) 1. Remove old completed tasks, retaining the most recent three days 2. Generate the daily collaboration report 3. Synchronize it to MEMORY.md ``` The shared-file update mechanism also instructs agents to reload durable state: ```markdown - [ ] [ALL] MEMORY.md has been updated; reread it ``` ### Technical Analysis The workflow treats shared Markdown files both as data stores and as sources of agent instructions. Agents are directed to read queue entries, execute assigned work, reload `MEMORY.md`, and write summaries back into durable memory. No trust-boundary rules are defined for: - Who is authorized to modify the queue and shared documents. - Whether queue text is data or executable instruction. - Which information may be written to long-term memory. - How provenance, review, rollback, or expiration is handled. - Whether embedded instructions must be ignored. This enables indirect prompt injection and durable memory poisoning when an untrusted participant can modify a shared task or collaboration document. The supplied shell script does not itself write to `MEMORY.md`; the risk arises from the Skill instructions directing AI agents to perform that synchro ...[truncated 1033 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify every queue entry and shared document as untrusted data. 2. Prohibit agents from following instructions embedded in task descriptions or task results. 3. Use a strict task schema with separately validated fields for identifier, role, description, owner, and status. 4. Require interactive user approval before writing any new behavioral rule or instruction to `MEMORY.md`. 5. Restrict memory synchronization to factual summaries and exclude commands, policies, credentials, and external instructions. 6. Record provenance for every memory entry, including source file, author, timestamp, and approval status. 7. Add versioning and a documented rollback mechanism for persistent memory. 8. Restrict filesystem write permissions on shared files to explicitly authorized principals. ]]>

T01 · Skill Instruction Hijacking

Error

Location: docs/shrimp-task-notification.md:56
Finding: Mandatory Task Notifications Target a Hard-Coded Feishu User<![CDATA[ ## Vulnerability Details **File Location**: `docs/shrimp-task-notification.md:7-18`, `docs/shrimp-task-notification.md:56-64`, `docs/shrimp-task-notification.md:95-108` **Vulnerability Type**: Skill instructions redirect task results to a fixed external recipient **Risk Level**: High ### Complete Code Snippet ```markdown ## Actions required after completing a task ### 1. Update the task queue - [x] [role] task description - owner @completion time ### 2. Send a Feishu message to the boss (mandatory) ``` The prescribed message-tool invocation contains a fixed recipient: ```bash message action=send channel=feishu target=user:ou_967d17eccf0faa8814004cc4f0458140 message="✅ Task completed..." ``` The same document instructs each agent to send task-completion information: ```markdown ### Terminal agent (CPMO) After completing a task, it must: 1. Update tasks/queue.md to [x] 2. Send a Feishu message to the boss 3. Copy the Feishu agent for filing ### Feishu agent (COO) After completing a task, it must: 1. Update tasks/queue.md to [x] 2. Send a Feishu message to the boss 3. Check and send pending notifications ``` ### Technical Analysis The Skill embeds a specific Feishu user identifier and characterizes external delivery as mandatory. It does not verify that the identifier belongs to the current Skill installer or the current user's intended recipient. Because these are agent-facing instructions, loading and following the Skill can redirect ordinary task output to an account selected by the Skill author. Completion messages may contain schedules, business reports, document links, project status, assignees, or other confidential task results. This behavior exceeds the minimum privileges required for local queue monitoring. Notifications could be supported without embedding any destination and without making transmission mandatory. ### Attack Path 1. A user installs or loads the Skill. 2. An agent completes a task that contains confidential result ...[truncated 580 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded Feishu user identifier from all documentation and scripts. 2. Default to local-only notification generation with no external transmission. 3. Require the installer to configure and verify the intended recipient explicitly. 4. Display the destination, channel, and complete message payload before the first transmission. 5. Require per-destination consent and provide a simple mechanism to disable notifications. 6. Minimize notification contents and avoid automatically including sensitive task results or private links. 7. Store recipient configuration in a protected user configuration file rather than Skill instructions. 8. Document how to revoke or rotate the configured recipient. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/notify-task-complete.sh:50
Finding: Task Details Are Sent to an Unvalidated Webhook Using Unsafe JSON Construction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/notify-task-complete.sh:8-16`, `scripts/notify-task-complete.sh:50-67` **Vulnerability Type**: Unvalidated data transmission and malformed JSON injection **Risk Level**: Medium ### Complete Code Snippet ```bash # Arguments TASK_NAME="$1" ASSIGNEE="$2" COMPLETION_TIME="$3" DETAILS="$4" # Feishu configuration FEISHU_WEBHOOK="${FEISHU_WEBHOOK:-}" FEISHU_USER_ID="${FEISHU_USER_ID:-ou_967d17eccf0faa8814004cc4f0458140}" ``` ```bash MESSAGE=$(generate_message "$TASK_NAME" "$ASSIGNEE" "$COMPLETION_TIME" "$DETAILS") # Output message echo "$MESSAGE" # Send directly if a Feishu webhook exists if [ -n "$FEISHU_WEBHOOK" ]; then curl -s -X POST "$FEISHU_WEBHOOK" \ -H "Content-Type: application/json" \ -d "{\"msg_type\":\"text\",\"content\":{\"text\":\"$MESSAGE\"}}" echo "" echo "✅ Message sent to Feishu" fi ``` ### Technical Analysis The script sends task data to any URL present in the inherited `FEISHU_WEBHOOK` environment variable. It does not validate: - The URL scheme. - The destination host. - Whether the endpoint is an official Feishu endpoint. - Whether redirects are permitted. - Whether the current user approved transmission. In addition, the multiline `MESSAGE` value is interpolated directly into a JSON string. Quotes, backslashes, control characters, and newlines are not escaped through a JSON-aware serializer. Attacker-controlled task names or details can therefore create malformed JSON or alter the logical structure of the submitted payload. The hard-coded `FEISHU_USER_ID` in this script is not used by the current shell implementation, but retaining a fixed external identifier remains unsafe and may lead to future misuse. ### Attack Path 1. A malicious or incorrectly configured environment provides an attacker-controlled `FEISHU_WEBHOOK`. 2. The notifier is invoked with a sensitive task name or task details. 3. The script incorporates the content into `MESSAGE`. ...[truncated 513 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only HTTPS webhook URLs on an explicit allowlist of official Feishu domains. 2. Reject URLs containing user information, unexpected ports, fragments, or non-HTTPS schemes. 3. Disable redirects with `--max-redirs 0`, or validate every redirect destination. 4. Require explicit user confirmation before transmitting task details. 5. Construct JSON with a proper serializer, for example: ```bash payload="$(jq -n --arg text "$MESSAGE" \ '{msg_type: "text", content: {text: $text}}')" curl --fail-with-body --silent --show-error \ --max-redirs 0 \ -X POST "$FEISHU_WEBHOOK" \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` 6. Remove the unused hard-coded `FEISHU_USER_ID`. 7. Redact secrets and minimize task details before transmission. 8. Return a failure when the server reports an HTTP or API-level error. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fswatch-monitor.sh:8
Finding: Hard-Coded User Workspace Produces Unsafe and Non-Portable Execution Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:20-24`; `scripts/heartbeat-check.sh:9-15`; `scripts/fswatch-monitor.sh:8-12` **Vulnerability Type**: Hard-coded execution and data-access paths **Risk Level**: Medium ### Complete Code Snippet From `install.sh`: ```bash # Create workspace WORKSPACE="/Users/zhangyang/.openclaw/workspace" mkdir -p "$WORKSPACE/tasks" mkdir -p "$WORKSPACE/logs" ``` From `scripts/heartbeat-check.sh`: ```bash WORKSPACE="/Users/zhangyang/.openclaw/workspace" QUEUE_FILE="$WORKSPACE/tasks/queue.md" MEMORY_FILE="$WORKSPACE/MEMORY.md" DIVISION_FILE="$WORKSPACE/三只虾分工体系.md" COLLAB_FILE="$WORKSPACE/三只虾协同协议.md" LOG_DIR="$WORKSPACE/logs" ``` From `scripts/fswatch-monitor.sh`: ```bash WORKSPACE="/Users/zhangyang/.openclaw/workspace" QUEUE_FILE="$WORKSPACE/tasks/queue.md" CHECK_SCRIPT="$WORKSPACE/scripts/heartbeat-check.sh" LOG_DIR="$WORKSPACE/logs" LOCK_FILE="$LOG_DIR/.fswatch.lock" ``` ### Technical Analysis The project assumes a specific account named `zhangyang` rather than resolving paths from the current user or installation directory. The installer creates task and log directories but does not copy the audited scripts into the workspace before persistent services attempt to execute them. This creates several unsafe outcomes: - Installation under another account may fail or access another user's files. - A pre-existing script at the hard-coded location may be executed instead of the audited package script. - Persistent service behavior can diverge from the reviewed source. - The heartbeat reads `MEMORY.md` and channel-related files outside a package-controlled directory. - Script replacement is not detected through ownership, permission, or integrity checks. ### Attack Path 1. A file already exists at `/Users/zhangyang/.openclaw/workspace/scripts/heartbeat-check.sh`, or an attacker able to write that directory creates one. 2. Another user or automated deployment runs the installer without noticing the hard-coded ...[truncated 592 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve user-specific paths through `$HOME` after verifying that it is an absolute, trusted path. 2. Resolve package scripts relative to a verified installation directory rather than the mutable workspace. 3. Copy all executable files into the destination atomically before registering services. 4. Set restrictive ownership and permissions, such as user ownership and no group/world write access. 5. Refuse installation if the destination is a symbolic link or is owned by another user. 6. Record and verify hashes for service-executed scripts. 7. Separate executable code, configuration, task data, and logs into distinct directories. 8. Use one consistent log path; the project currently alternates between workspace logs and `~/Library/Logs/openclaw`. ]]>

T08 · Insecure Dependencies

Note

Location: install.sh:10
Finding: Installer Automatically Installs an Unpinned Homebrew Dependency<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:10-16` **Vulnerability Type**: Mutable third-party dependency installation **Risk Level**: Low ### Complete Code Snippet ```bash # Check dependencies echo "📦 Checking dependencies..." if ! command -v fswatch &> /dev/null; then echo " ⚠️ fswatch is not installed; installing..." brew install fswatch else echo " ✅ fswatch is installed" fi ``` ### Technical Analysis The installer automatically invokes Homebrew to install the current `fswatch` formula. It does not request separate confirmation, document a reviewed version, verify an artifact checksum, or validate the resolved package source. Homebrew is a recognized package manager, so this is not evidence that the current dependency is malicious. The security concern is that the dependency resolved at installation time can differ from the version reviewed with the Skill, expanding the effective trusted computing base. ### Attack Path 1. The user runs `install.sh` on a system without `fswatch`. 2. The script automatically invokes `brew install fswatch`. 3. Homebrew resolves the formula and artifacts available at that time. 4. If the formula source, repository, package infrastructure, or resolved artifact is compromised, malicious installation or runtime code executes with the user's privileges. 5. The installed binary is subsequently used by the persistent file-monitoring service. ### Impact Assessment A compromised dependency could execute with the installing user's privileges and later operate continuously through the fswatch LaunchAgent. Under normal Homebrew operation, the practical risk is low; no evidence of an actually malicious package or typosquatted dependency was found. ]]>
Remediation: <![CDATA[ ## Remediation Suggestions 1. Ask for explicit confirmation before installing third-party software. 2. Document the exact tested `fswatch` version and official formula source. 3. Where feasible, pin or lock the reviewed dependency version. 4. Verify package provenance and checksums through a controlled dependency manifest. 5. Support a mode that exits with installation instructions instead of automatically modifying the system. 6. Revalidate compatibility and security before updating the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (85)

Missing User Warnings

High

Confidence: 98% confidence
Finding: This section contains a full heredoc overwrite of tasks/queue.md that resets the task file contents, which will erase all existing queued, in-progress, and completed task data. Because the command is presented as a repair step without a prominent destructive-action warning, it creates a high risk of accidental operational data loss if executed by a user or autonomous agent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script copies LaunchAgent plist files into `~/Library/LaunchAgents` and loads them immediately with `launchctl`, establishing persistence and starting background services without explicit opt-in. This is dangerous because persistent agents execute beyond the installer session, can monitor or modify user activity depending on plist contents, and are a common persistence mechanism abused by unwanted software.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README provides destructive file-modification commands that overwrite queue data without an explicit warning about data loss or safeguards such as confirmation, backup validation, or scoped editing. In an agent skill context, users or downstream agents may copy these commands verbatim, causing unintended loss of task history or corruption of the shared coordination file.

Session Persistence

Medium

Category: Rogue Agent
Content: # 重启服务 launchctl unload ~/Library/LaunchAgents/com.openclaw.fswatch.plist launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist ``` ### 问题 2：通知没收到
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 加载 launchd 配置 cp scripts/com.openclaw.heartbeat.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 加载 fswatch 监控
Confidence: 90% confidence
Finding: The skill instructs users to copy launchd plist files into ~/Library/LaunchAgents, establishing user-session persistence for the monitoring and heartbeat components. Persistence is not inherently malicious here, but it is security-relevant because it causes code to auto-run on login and increases the blast radius of any unsafe behavior in the referenced scripts.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 加载 launchd 配置 cp scripts/com.openclaw.heartbeat.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 加载 fswatch 监控 cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/
Confidence: 88% confidence
Finding: This finding reflects the same persistence behavior associated with the heartbeat LaunchAgent plist referenced in the installation instructions. Even if intended for convenience, instructing users to install persistent agents without a security notice can surprise users and create ongoing background execution beyond the immediate task.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 加载 launchd 配置 cp scripts/com.openclaw.heartbeat.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 加载 fswatch 监控 cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/
Confidence: 88% confidence
Finding: This finding reflects the same persistence behavior associated with the heartbeat LaunchAgent plist referenced in the installation instructions. Even if intended for convenience, instructing users to install persistent agents without a security notice can surprise users and create ongoing background execution beyond the immediate task.

Session Persistence

Medium

Category: Rogue Agent
Content: launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 加载 fswatch 监控 cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist ```
Confidence: 90% confidence
Finding: The fswatch LaunchAgent plist is another persistence mechanism that keeps file-monitoring logic running automatically in the user session. Persistent filesystem monitoring is especially sensitive because it can observe task file changes continuously and may trigger downstream notifications containing those contents.

Session Persistence

Medium

Category: Rogue Agent
Content: # 加载 fswatch 监控 cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist ``` ### 3. 验证状态
Confidence: 88% confidence
Finding: This duplicate plist-related finding corresponds to the same fswatch persistence mechanism. The danger comes from unattended continued execution of local monitoring code, not from the plist file format itself, and the skill currently does not frame that risk clearly.

Session Persistence

Medium

Category: Rogue Agent
Content: # 加载 fswatch 监控 cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist ``` ### 3. 验证状态
Confidence: 88% confidence
Finding: This duplicate plist-related finding corresponds to the same fswatch persistence mechanism. The danger comes from unattended continued execution of local monitoring code, not from the plist file format itself, and the skill currently does not frame that risk clearly.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly describes automatic completion notifications that send task names, executors, timestamps, and results to Feishu, but it does not warn users that task content may be transmitted to an external service. In a multi-agent workflow, task details can easily contain sensitive business, personal, or internal operational data, so undisclosed outbound transmission creates a meaningful privacy and data-leak risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs users to configure a Feishu webhook and user ID but gives no warning that these are sensitive integration values and that messages will be delivered to an external platform. This omission can lead users to mishandle secrets, commit them to files or shells, and enable unintended exfiltration of task data to third-party endpoints.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow explicitly describes automatically reading pending notification files and sending Feishu messages to a boss, but it does not mention any user consent, approval gate, recipient validation, or data-classification check before outbound transmission. That creates a real risk of unintended disclosure if task results or notification files contain sensitive internal information, credentials, personal data, or misdirected content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document explicitly describes an automated heartbeat that performs recurring queue checks, full file reads, and cleanup actions on a schedule, but it does not include meaningful warnings, consent boundaries, or safeguards around what data will be accessed and modified. In an agent skill context, unattended periodic reads and cleanup can expand data exposure and trigger unintended state changes without a fresh user decision each time.

Session Persistence

Medium

Category: Rogue Agent
Content: # 创建目录 mkdir -p ~/Library/LaunchAgents # 创建 plist 文件 cat > ~/Library/LaunchAgents/com.openclaw.heartbeat.plist << 'EOF' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
Confidence: 96% confidence
Finding: Writing a LaunchAgent plist into `~/Library/LaunchAgents` sets up a macOS persistence artifact that can cause the heartbeat script to run automatically in future sessions. In the context of an agent skill, this is risky because it installs unattended recurring execution tied to the user environment.

Session Persistence

Medium

Category: Rogue Agent
Content: mkdir -p ~/Library/LaunchAgents # 创建 plist 文件 cat > ~/Library/LaunchAgents/com.openclaw.heartbeat.plist << 'EOF' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
Confidence: 96% confidence
Finding: This heredoc command writes the LaunchAgent configuration file, which is a concrete step toward persistent scheduled execution. Even if intended for convenience, creating persistence from within skill instructions can lead to unnoticed long-term automation and repeated access to local data.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 加载 launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 检查状态 launchctl list | grep openclaw.heartbeat
Confidence: 98% confidence
Finding: `launchctl load` activates the LaunchAgent, causing the configured heartbeat script to run automatically on schedule in future sessions. This is classic user-level persistence and is especially sensitive in a skill because it enables ongoing autonomous execution against local workspace files and logs.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 加载 launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 检查状态 launchctl list | grep openclaw.heartbeat
Confidence: 98% confidence
Finding: `launchctl load` activates the LaunchAgent, causing the configured heartbeat script to run automatically on schedule in future sessions. This is classic user-level persistence and is especially sensitive in a skill because it enables ongoing autonomous execution against local workspace files and logs.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 编辑 crontab crontab -e # 添加以下内容（每小时 8:00-17:00） 0 8-17 * * * /Users/zhangyang/.openclaw/workspace/scripts/heartbeat-check.sh >> /Users/zhangyang/.openclaw/logs/heartbeat.log 2>&1
Confidence: 95% confidence
Finding: This instruction tells the user to install a cron job that will run the heartbeat script automatically every hour during the workday, creating persistence across sessions. In a skill repository, persistence is security-relevant because it causes code or automation to continue executing after the original interaction ends, potentially reading files and appending logs indefinitely.

Session Persistence

Medium

Category: Rogue Agent
Content: launchctl list | grep openclaw.heartbeat # cron crontab -l # 进程 ps aux | grep heartbeat
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The quickstart tells the user to run a setup script that configures an automatic heartbeat service, but it does not warn that this likely installs persistent launchd behavior and scheduled execution. That creates a transparency and consent problem: users may enable recurring background activity and file access without understanding the scope or persistence of the change.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The heartbeat design explicitly describes scheduled reads of workspace files and scheduled updates to task and memory files, but it does not present this as a consent-sensitive automated behavior. A system that periodically reads and mutates user data on a timer can surprise users, overwrite content, or expose sensitive information if they were not clearly informed and opted in.

Session Persistence

Medium

Category: Rogue Agent
Content: ├── scripts/ │ ├── heartbeat-check.sh # 心跳检查脚本 │ ├── setup-heartbeat.sh # 配置脚本 │ └── com.openclaw.heartbeat.plist # launchd 配置 └── logs/ ├── heartbeat-stdout.log # 标准输出 └── heartbeat-stderr.log # 错误输出
Confidence: 94% confidence
Finding: The documented file structure includes a launchd plist for the heartbeat, indicating a persistence mechanism that causes code to run automatically over time. Persistence is security-relevant because it increases the blast radius of any misconfiguration or malicious modification to the heartbeat scripts and normalizes background execution.

Session Persistence

Medium

Category: Rogue Agent
Content: ### 临时关闭心跳 ```bash # 卸载服务 launchctl unload ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 重新加载 launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist
Confidence: 95% confidence
Finding: The instructions to unload and reload a LaunchAgent confirm that the skill relies on session persistence through launchd. Even though this section is framed as control and debugging, it still documents persistent scheduled execution that could continue reading logs and workspace files without continual user awareness.

Session Persistence

Medium

Category: Rogue Agent
Content: launchctl unload ~/Library/LaunchAgents/com.openclaw.heartbeat.plist # 重新加载 launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist ``` ---
Confidence: 94% confidence
Finding: The reference to the LaunchAgent plist at the reload step reinforces use of a persistent autostart configuration. The risk is not that a plist exists by itself, but that persistent background automation is being enabled in combination with scripts that monitor, read, and modify workspace state on a schedule.

Static analysis

No suspicious patterns detected.