Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed crash-recovery tool, but it installs persistent hooks that can automatically read session history and resume agent work without fresh user confirmation.
Install only if you explicitly want automatic recovery across OpenClaw agents after restarts or wake events. Inspect the systemd unit/drop-in files before enabling them, consider using manual invocation instead, and verify uninstall removes the user service, drop-in, copied script, and any partial files left by a failed install.
install.sh:52Persistent Automatic Execution Through systemd Hooks and Scheduled Agent Events
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm ~/.config/systemd/user/openclaw-gateway.service.d/boot-resume.conf
systemctl --user disable boot-resume-wake.service 2>/dev/null
rm ~/.config/systemd/user/boot-resume-wake.service
systemctl --user daemon-reload
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm ~/.config/systemd/user/openclaw-gateway.service.d/boot-resume.conf
systemctl --user disable boot-resume-wake.service 2>/dev/null
rm ~/.config/systemd/user/boot-resume-wake.service
systemctl --user daemon-reload
rm ~/.openclaw/workspace/scripts/boot-resume-check.sh
rm -rf ~/.openclaw/workspace/skills/boot-resume
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
systemctl --user disable boot-resume-wake.service 2>/dev/null rm ~/.config/systemd/user/boot-resume-wake.service systemctl --user daemon-reload rm ~/.openclaw/workspace/scripts/boot-resume-check.sh rm -rf ~/.openclaw/workspace/skills/boot-resume
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm ~/.config/systemd/user/boot-resume-wake.service systemctl --user daemon-reload rm ~/.openclaw/workspace/scripts/boot-resume-check.sh rm -rf ~/.openclaw/workspace/skills/boot-resume
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm ~/.config/systemd/user/boot-resume-wake.service systemctl --user daemon-reload rm ~/.openclaw/workspace/scripts/boot-resume-check.sh rm -rf ~/.openclaw/workspace/skills/boot-resume
The README explicitly describes automatically injecting resume events into prior sessions after a restart or wake, but it does not clearly warn users that this modifies conversation state autonomously. In a recovery skill that scans historical session artifacts and triggers actions without user confirmation, lack of disclosure increases the risk of unintended actions, duplicate operations, or resuming sensitive workflows unexpectedly.
The installation instructions create user-level systemd service directories and place configuration files that hook into gateway startup behavior, which is a persistence mechanism. In the context of a tool that scans session files and injects resume events automatically, this persistence increases risk because it causes autonomous behavior to survive restarts and user logins without a fresh trust decision.
cp scripts/boot-resume-check.sh ~/.openclaw/workspace/scripts/
chmod +x ~/.openclaw/workspace/scripts/boot-resume-check.sh
mkdir -p ~/.config/systemd/user/openclaw-gateway.service.d
cp templates/boot-resume.conf ~/.config/systemd/user/openclaw-gateway.service.d/
cp templates/boot-resume-wake.service ~/.config/systemd/user/
systemctl --user daemon-reload
The README instructs users to enable a persistent user-level systemd service that will run automatically on wake/restart, creating durable execution behavior. Persistence mechanisms are security-relevant because they make the skill continue operating beyond the initiating session and can repeatedly trigger autonomous session recovery, magnifying the effects of misconfiguration or abuse.
cp templates/boot-resume.conf ~/.config/systemd/user/openclaw-gateway.service.d/ cp templates/boot-resume-wake.service ~/.config/systemd/user/ systemctl --user daemon-reload systemctl --user enable boot-resume-wake.service
## Test
The skill clearly instructs the agent/user to execute shell commands and install persistent systemd hooks, but it declares no explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and informed consent, making it easier for an agent runtime to invoke shell-capable behavior without an upfront capability declaration.
The install and uninstall sections direct modification of user systemd units, service enablement, and file deletion, but they do not prominently warn that these actions create persistence and alter startup behavior. In a skill context, omission of that warning increases the chance of unsafe execution by users or agents who may treat the instructions as routine setup.
Copying drop-in configuration into ~/.config/systemd/user/openclaw-gateway.service.d/ alters the startup behavior of another service so the recovery script runs automatically after gateway start. This is a persistence mechanism and increases attack surface because future gateway restarts will trigger whatever script path is configured there.
cp {baseDir}/scripts/boot-resume-check.sh ~/.openclaw/workspace/scripts/
chmod +x ~/.openclaw/workspace/scripts/boot-resume-check.sh
mkdir -p ~/.config/systemd/user/openclaw-gateway.service.d
cp {baseDir}/templates/boot-resume.conf ~/.config/systemd/user/openclaw-gateway.service.d/
cp {baseDir}/templates/boot-resume-wake.service ~/.config/systemd/user/
Enabling a user systemd service establishes persistence across future logins/restarts, causing the skill's recovery logic to run automatically outside the immediate user invocation. Persistence is security-sensitive because a compromised or modified script would continue executing repeatedly with the user's privileges.
cp {baseDir}/templates/boot-resume-wake.service ~/.config/systemd/user/
systemctl --user daemon-reload systemctl --user enable boot-resume-wake.service
## Verify
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "✓ Deployed wake service → $WAKE_SERVICE_DIR/"
fi
# Reload systemd and enable wake service
systemctl --user daemon-reload 2>/dev/null && echo "✓ Reloaded systemd" || echo "⚠ systemctl daemon-reload failed"
systemctl --user enable boot-resume-wake.service 2>/dev/null && echo "✓ Enabled wake service" || echo "⚠ Could not enable wake service"
Enabling a user service establishes persistence so the recovery logic runs automatically in future sessions, which matches the skill's stated purpose of automatic resume after restart or wake. While not inherently malicious, persistence mechanisms are security-relevant because they cause code to execute automatically on later logins/starts and could be abused if the deployed script is modified or untrusted.
# Reload systemd and enable wake service
systemctl --user daemon-reload 2>/dev/null && echo "✓ Reloaded systemd" || echo "⚠ systemctl daemon-reload failed"
systemctl --user enable boot-resume-wake.service 2>/dev/null && echo "✓ Enabled wake service" || echo "⚠ Could not enable wake service"
elif [[ "$(uname)" == "Darwin" ]]; then
echo ""
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
elif [[ "$(uname)" == "Darwin" ]]; then
echo ""
echo "⚠ macOS detected. Systemd is not available."
echo " To run the script on gateway start, add this to your launchd plist"
echo " or use a wrapper script that calls:"
echo ""
echo " $SCRIPT_TARGET >> /tmp/openclaw/boot-resume.log 2>&1 &"
The file includes a full Chinese section in addition to English, but it does not explicitly state language-selection behavior or whether users can choose their preferred locale. Because the policy calls for flagging language/locale constraints unless choice or justification is documented, the bilingual presentation should clarify that language is optional and user-selected.