Security audit
Security checks for vulnerabilities and agentic risk
ClawGuard is purpose-built and mostly transparent, but it installs an always-on watchdog that can automatically rewrite OpenClaw configuration and send service diagnostics, so users should review it before installing.
Install only if you want a persistent OpenClaw watchdog running in your user session. Review the service files it creates, understand how to disable the systemd/launchd service, and be comfortable with automatic OpenClaw config rollback and alert messages that may include local service diagnostics.
The skill describes installation and operation of a daemon, CLI, and shell-based system integration, but its frontmatter declares no explicit tool scope or permissions. That omission can mislead users and agents about the skill's capabilities, increasing the chance that file modification, shell execution, and persistent service installation occur without informed approval.
The skill advertises automatic config backup, revert, and retry behavior for gateway restarts, but does not give a prominent warning that it may restore older configuration state automatically. This can unexpectedly overwrite intended changes, roll back security settings, or cause integrity and availability issues if the wrong backup is reapplied.
The install section enables a systemd user service or launchd agent with auto-start and Restart=always, creating continuous background monitoring and persistence across reboots without a prominent warning. Persistent monitoring of PIDs, logs, and directories changes the user's system state and can continue running long after the immediate task, which is risky if the user did not knowingly consent.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
parser = argparse.ArgumentParser(prog="claw-guard")
sub = parser.add_subparsers(dest="cmd")
p = sub.add_parser("register", help="Register a task for monitoring")
p.add_argument("--id", required=True)
p.add_argument("--pid", type=int, required=True)
p.add_argument("--target", required=True, help="Notification target (room:!id:server, telegram:id, etc.)")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
else:
# No target — let OpenClaw route to default channel
cmd = ["openclaw", "message", "send", "--message", message]
subprocess.run(cmd, capture_output=True, text=True, timeout=15)
except Exception as e:
log(f" Notify error: {e}")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def gateway_active():
try:
if IS_MACOS:
r = subprocess.run(["launchctl", "list"], capture_output=True, text=True, timeout=5)
return "openclaw" in r.stdout.lower()
else:
r = subprocess.run(
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
r = subprocess.run(["launchctl", "list"], capture_output=True, text=True, timeout=5)
return "openclaw" in r.stdout.lower()
else:
r = subprocess.run(
["systemctl", "--user", "is-active", "openclaw-gateway.service"],
capture_output=True, text=True, timeout=5)
return r.stdout.strip() == "active"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def gateway_status_error():
try:
if IS_MACOS:
r = subprocess.run(["launchctl", "list", "com.openclaw.gateway"],
capture_output=True, text=True, timeout=10)
return (r.stdout or r.stderr)[-500:]
else:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
capture_output=True, text=True, timeout=10)
return (r.stdout or r.stderr)[-500:]
else:
r = subprocess.run(
["systemctl", "--user", "status", "openclaw-gateway.service"],
capture_output=True, text=True, timeout=10)
return r.stdout[-500:] if r.stdout else "no output"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return logs[0].read_text()[-500:]
return ""
else:
r = subprocess.run(
["journalctl", "--user-unit", "openclaw-gateway.service", "-n", "20", "--no-pager"],
capture_output=True, text=True, timeout=10)
return r.stdout[-500:] if r.stdout else ""
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
if IS_MACOS:
uid = os.getuid()
subprocess.run(["launchctl", "kickstart", "-k", f"gui/{uid}/com.openclaw.gateway"],
capture_output=True, text=True, timeout=30)
else:
subprocess.run(["systemctl", "--user", "restart", "openclaw-gateway.service"],
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
subprocess.run(["launchctl", "kickstart", "-k", f"gui/{uid}/com.openclaw.gateway"],
capture_output=True, text=True, timeout=30)
else:
subprocess.run(["systemctl", "--user", "restart", "openclaw-gateway.service"],
capture_output=True, text=True, timeout=30)
except Exception as e:
log(f" Restart command failed: {e}")
On restart failure, the code sends slices of service status and recent journal content through the messaging channel to the registered target. Those diagnostics can contain sensitive local paths, configuration values, usernames, host details, error traces, or tokens accidentally written to logs, creating an information-disclosure channel to any party that can influence or receive the target notification.
The installer immediately copies executables into a persistent user directory and later installs a long-running user service without any explicit upfront warning or confirmation. Even if this is intended functionality for a watchdog, silently creating persistence and startup behavior reduces informed consent and makes abuse or accidental installation harder for users to notice.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
CURRENT_PATH="$PATH"
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
CURRENT_PATH="$PATH"
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
CURRENT_PATH="$PATH"
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
CURRENT_PATH="$PATH"
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
Although this duplicate finding is triggered on the plist content boundary, the underlying issue is the same: the script begins creating a LaunchAgent configuration that will persist across sessions. Persistent autostart increases risk if the installed Python scripts are later altered or replaced.
if [ "$OS" = "Darwin" ]; then
# macOS — launchd plist
PLIST_DIR="$HOME/Library/LaunchAgents"
PLIST="$PLIST_DIR/com.openclaw.claw-guard.plist"
mkdir -p "$PLIST_DIR"
cat > "$PLIST" << PLIST
<?xml version="1.0" encoding="UTF-8"?>