Self-Heal Watchdog

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:17 AM UTC
• Version: 1.0.0

Overview

This watchdog is mostly purpose-aligned, but it installs a recurring service that can edit configuration and restart OpenClaw, and its scripts contain confirmed code-injection risks.

Review before installing. This is not a hidden exfiltration skill, but it should be treated as operationally sensitive: it installs a every-minute LaunchAgent, can modify OpenClaw config, and can restart the gateway. Fix or audit the eval/Python interpolation and PATH issues before using it outside a disposable or tightly controlled environment.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/model-failover.sh:19

Finding

Shell Command Injection Through Persisted Model State

Content

View full analysis

/dev/null)" ``` ### Technical Analysis The script converts values read from `watchdog-state.json` into shell assignment statements and executes the generated text with `eval`. The values are inserted without shell escaping. Consequently, model names or failed-model data containing shell metacharacters, command substitutions, backticks, quotation marks, or statement separators can alter the generated shell program. For example, a `current_model` value containing `$(command)` is evaluated as part of the generated assignment rather than retained as literal data. The state file is initially derived from the primary model in `openclaw.json`, and it is subsequently modified by the watchdog. A crafted configuration value can therefore reach this execution sink. Direct modification of the user-owned state file is another possible input path. ### Attack Path 1. An attacker or compromised configuration source places a malicious model identifier in `openclaw.json`, or modifies `watchdog-state.json` directly. 2. The malicious value includes shell syntax such as command substitution. 3. Setup copies the configured primary model into the persistent watchdog state, or the altered state is otherwise retained. 4. Model failover is triggered manually or automatically after repeated ...[truncated 920 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/model-failover.sh:101

Finding

Python Code Injection Through Unescaped Model Identifiers

Content

View full analysis

/dev/null ``` The current and next model values are inserted again when updating state: ```bash # ── Update state file ── python3 -c " import json with open('$STATE_FILE') as f: d = json.load(f) d['current_model'] = '$NEXT_MODEL' d['last_failover'] = '$(iso_now)' d['fail_count'] = 0 failed = d.get('failed_models', []) if '$CURRENT_MODEL' not in failed: failed.append('$CURRENT_MODEL') d['failed_models'] = failed with open('$STATE_FILE', 'w') as f: json.dump(d, f, indent=2) " 2>/dev/null ``` ### Technical Analysis `NEXT_MODEL` and `CURRENT_MODEL` originate from JSON configuration or persistent state but are interpolated directly into a string passed to `python3 -c`. They are therefore treated as part of the Python program rather than as data. A model or provider identifier containing a single quote and valid Python syntax can terminate the intended string literal and inject additional statements. Shell quoting does not make this safe because the interpolation occurs inside a Bash double-quoted argument. Paths such as `CONFIG_FILE` and `STATE_FILE` are constructed from environment-controlled locations and are also inserted into Python source using the same unsafe pattern, increasing the available i ...[truncated 1387 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/setup.sh:119

Finding

Recurring LaunchAgent Execution Uses a Hijackable Executable Search Path

Content

View full analysis

EnvironmentVariables PATH /usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.npm-global/bin HOME ``` ### Technical Analysis The LaunchAgent executes the watchdog every 60 seconds. The watchdog and its child scripts invoke security-relevant tools by unqualified name, including `openclaw`, `python3`, `curl`, `pgrep`, and other standard utilities. The configured search path includes third-party installation directories such as `/usr/local/bin` and `/opt/homebrew/bin`. Depending on local ownership and permissions, these locations may be writable by the user or another local software installation mechanism. The user-controlled npm-global directory can also supply executables that do not exist in earlier directories, notably the `openclaw` command. If an attacker can place a spoofed executable under a matching name in the first applicable writable search-path directory, the recurring LaunchAgent will execute the attacker's program while appearing to invoke a legitimate tool. ### Attack Path 1. An attacker gains the ability to create or replace an executable in one of the LaunchAgent's applicable search-path directories. 2. The attacker creates a malicious executable named after a command used by the watchdog, such as `openclaw`, or another command not found in an earlier directory. 3. The LaunchAgent runs the watchdog at its next 60-second interval. 4. Shell command lookup resolves the unqualified command name to the attacker's executable. 5. The malicious executable runs with the privileges and environment of the LaunchAgent user. 6. The process repeats on subsequent intervals until the spoofed executable or LaunchAgent is removed. ### Impact Assessment Success ...[truncated 467 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (47)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

launchctl unload ~/Library/LaunchAgents/com.openclaw.watchdog.plist

Remove files

rm -rf ~/.openclaw/watchdog rm ~/Library/LaunchAgents/com.openclaw.watchdog.plist

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

launchctl unload ~/Library/LaunchAgents/com.openclaw.watchdog.plist

Remove files

rm -rf ~/.openclaw/watchdog rm ~/Library/LaunchAgents/com.openclaw.watchdog.plist

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 108)May include surrounding context.

Remove files

rm -rf ~/.openclaw/watchdog rm ~/Library/LaunchAgents/com.openclaw.watchdog.plist

text

## Platform Support

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/status.sh (reported line 84)May include surrounding context.

sh

ME/Library/LaunchAgents/com.openclaw.watchdog.plist"
if [[ -f "$LAUNCHD_PLIST" ]]; then
    if launchctl list | grep -q "com.openclaw.watchdog" 2>/dev/null; then
        echo -e "  ${GREEN}✅ launchd active${NC} (com.openclaw.watchdog, every 60s)"
    else
        echo -e "  ${YELLOW}⚠️  launchd plist exists but not loaded${NC}"
        echo "  Run: launchctl load $LAUNCHD_PLIST"
    fi
elif crontab -l 2>/dev/null | grep -q "openclaw-watchdog"; then
    CRON_LINE=$(crontab -l 2>/dev/null | grep "openclaw-watchdog")
    echo -e "  ${GREEN}✅ Cron registered${NC}"
    echo "  $CRON_LINE"
else
    echo -e "  ${RED}❌ No scheduler registered${NC}"
    echo "  Run setup.sh to install"
fi

# ── Config backup ──
echo ""
echo -e "${BOLD}💾 Config Backups:${NC}"
for ext in .bak .bak.prev; do
    if [[ -f "${CONFIG_FILE}${ext}" ]]; then
        SIZE=$(ls -lh "${CONFIG_FILE}${ext}" | awk '{print $5}')
        TIME=$(stat -f '%Sm' -t '%Y-%m-%d %H:%M' "${CONFIG_FILE}${ext}" 2>/dev/

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README prominently advertises automatic rollback, restart, and model failover, but it does not clearly warn users that the tool can autonomously modify configuration and restart services. In a self-healing/watchdog skill, those actions are expected, but the lack of an explicit caution increases the risk of unintended operational disruption or surprising state changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The README describes installing files under the user's home directory and registering a launchd service that executes periodically, which is a persistence mechanism. In legitimate watchdog software this can be acceptable, but from a security-analysis perspective it is still persistence behavior and should be treated carefully because it enables recurring unattended execution.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

text

This will:
1. Create `~/.openclaw/watchdog/` directory
2. Copy scripts to `~/.openclaw/watchdog/`
3. Register as launchd service (every 60 seconds)
4. Create initial config backup

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and instructs execution of shell scripts that can modify configuration, restart services, and install scheduled tasks, but it declares no explicit tool scope such as permissions or allowed-tools. That mismatch creates an authorization and review gap: an agent or operator may invoke a skill with filesystem-write and shell side effects without clear upfront constraints, increasing the chance of unsafe execution or privilege misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list includes broad operational terms like 'monitoring', 'recovery', 'health check', and 'gateway restart', which could cause this skill to activate for routine requests that only loosely relate to self-healing. Because the skill performs potentially disruptive actions such as restarting services, switching models, and rolling back config, overbroad routing increases the risk of unintended execution and service impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Most of the user-facing instructions and operational guidance are presented only in Chinese, but the file does not state that the skill is intended exclusively for Chinese-speaking users or provide an opt-in language choice. This can violate language/locale policy expectations when a skill implicitly forces a language for all users.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 65)May include surrounding context.

md

macOS 使用 launchd 而非 cron：

- **Plist:** `~/Library/LaunchAgents/com.openclaw.watchdog.plist`
- **间隔:** 每 60 秒
- **Label:** `com.openclaw.watchdog`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 78)May include surrounding context.

launchctl unload ~/Library/LaunchAgents/com.openclaw.watchdog.plist

手动加载

launchctl load ~/Library/LaunchAgents/com.openclaw.watchdog.plist

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 136)May include surrounding context.

sh

launchctl unload ~/Library/LaunchAgents/com.openclaw.watchdog.plist

# 手动加载
launchctl load ~/Library/LaunchAgents/com.openclaw.watchdog.plist
```

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/status.sh (reported line 82)May include surrounding context.

sh

launchctl unload ~/Library/LaunchAgents/com.openclaw.watchdog.plist

# 手动加载
launchctl load ~/Library/LaunchAgents/com.openclaw.watchdog.plist
```

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script makes persistent changes to the active configuration and state files, then restarts the gateway automatically without any user confirmation, approval gate, or safety interlock. In a self-healing skill this behavior is functionally intended, but it is still dangerous because a false trigger, bad state, or manipulated config can cause unreviewed service changes, downtime, or switching to an unintended model.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

md

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 108)May include surrounding context.

md

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 65)May include surrounding context.

md

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 75)May include surrounding context.

md

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 78)May include surrounding context.

md

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 11)May include surrounding context.

sh

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 101)May include surrounding context.

sh

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 102)May include surrounding context.

sh

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 129)May include surrounding context.

sh

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/status.sh (reported line 76)May include surrounding context.

sh

CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
CRON_MARKER="# openclaw-watchdog"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/com.openclaw.watchdog.plist"

# Colors
GREEN='\033[0;32m'

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.md:107