OpenClaw Rescue Gateway Skill.md

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:38 AM UTC
• Version: 1.0.1

Overview

The skill’s rescue-bot purpose is clear, but it recommends a persistent Discord-connected agent with full command access, no approval prompts, and copied credentials.

Install only if you deliberately want a persistent emergency Discord gateway with broad local authority. Before using it, prefer separate low-privilege rescue credentials, keep command approval on where possible, restrict Discord users/channels and subagents, avoid copying the primary auth profile wholesale, and document how to stop the LaunchAgent and revoke tokens.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:135

Finding

Persistent Independently Managed Rescue Gateway Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 135-163
Vulnerability Type: Persistent startup service
Risk Level: High

Vulnerable Code

text

~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist

bash

launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist
launchctl enable gui/$(id -u)/ai.openclaw.gateway.rescue
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway.rescue

The service is assigned the independent label:

text

ai.openclaw.gateway.rescue

Its startup arguments and environment are instructed to include:

text

--profile rescue gateway --port 19001
OPENCLAW_PROFILE=rescue
OPENCLAW_STATE_DIR=~/.openclaw-rescue
OPENCLAW_CONFIG_PATH=~/.openclaw-rescue/openclaw.json
OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue

Technical Analysis

The Skill instructs the user to create, register, enable, and start a macOS LaunchAgent for a Discord-connected OpenClaw gateway. A LaunchAgent is a cross-session persistence mechanism. The custom label intentionally separates this service from the primary gateway's lifecycle, allowing it to continue operating when the primary gateway is stopped.

Persistence is consistent with the stated rescue-gateway purpose, but it creates a durable remote agent entry point. The risk becomes especially severe when combined with the unrestricted execution and approval-bypass configuration elsewhere in the same file. The documentation also does not make restricted, on-demand execution the default.

Attack Path

1. A user follows the Skill and creates the rescue LaunchAgent property list.
2. The user registers and enables it through launchctl bootstrap and launchctl enable.
3. The rescue gateway starts under an independent service label and remains outside the normal primary-gateway stop lifecycle.
4. An attacker compromises an authorized Discord identity, rescue bot token, ...[truncated 755 chars]

Remediation

View remediation

Remediation Suggestions

• Do not register or enable the rescue gateway as a persistent LaunchAgent by default.
• Prefer an explicitly invoked, on-demand emergency service that stops automatically after a short timeout.
• If persistence is operationally required, document that it is a security-sensitive deployment decision and require explicit administrator confirmation.
• Run the gateway under a dedicated, non-administrative account with a restricted home directory and minimal filesystem permissions.
• Apply network and channel access controls, including strict Discord user or role allowlists and independently generated gateway credentials.
• Add monitoring for service registration, startup, authentication events, tool execution, configuration changes, and unexpected restarts.
• Provide complete disablement and removal procedures using launchctl bootout, deletion of the property list, and revocation of associated tokens.
• Combine any persistent deployment with the least-privilege execution controls described in the remediation for the unrestricted-execution finding.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:88

Finding

Unrestricted Approval-Free Agent Command Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 88-110
Vulnerability Type: Excessive execution privileges and disabled authorization controls
Risk Level: Critical

Vulnerable Code

json

{
  "agents": {
    "defaults": {
      "elevatedDefault": "full",
      "workspace": "/Users/YOUR_NAME/.openclaw-rescue/workspace"
    },
    "list": [
      {
        "id": "rescue",
        "workspace": "/Users/YOUR_NAME/.openclaw-rescue/workspace",
        "agentDir": "/Users/YOUR_NAME/.openclaw-rescue/agents/rescue/agent",
        "subagents": { "allowAgents": ["*"] }
      }
    ]
  },
  "tools": {
    "profile": "full",
    "exec": {
      "security": "full",
      "ask": "off"
    }
  }
}

The same configuration also enables automatic plugin approval:

json

{
  "plugins": {
    "entries": {
      "acpx": {
        "enabled": true,
        "config": {
          "permissionMode": "approve-all"
        }
      }
    }
  }
}

Technical Analysis

The configuration grants the rescue agent the full tool profile, full command-execution security level, elevated operation by default, access to every subagent, and automatic approval of plugin actions. Setting ask to off and permissionMode to approve-all removes human authorization checkpoints that could otherwise prevent dangerous or unexpected operations.

These permissions are broader than necessary for a backup communication gateway. Any untrusted instruction accepted by the agent—including a malicious Discord message, prompt injection in retrieved content, compromised plugin output, or an operator mistake—can potentially reach command-execution functionality without an approval barrier.

The loopback gateway binding does not adequately mitigate this exposure because Discord remains an external message channel. The effective security boundary therefore depends on Discord authorization ...[truncated 1491 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the full tool profile with a minimal allowlist containing only operations necessary for emergency diagnosis and recovery.
• Set execution security to a restricted mode and require explicit approval for commands that modify files, launch processes, access credentials, or change services.
• Remove elevatedDefault: "full" and make elevation an exceptional, time-limited, independently authorized action.
• Replace allowAgents: ["*"] with an explicit list of reviewed subagents.
• Replace permissionMode: "approve-all" with per-operation authorization or a narrowly scoped plugin policy.
• Enforce strict Discord server, channel, role, and user allowlists. Reject direct messages and untrusted servers unless specifically required.
• Run the gateway in a sandbox, container, or dedicated low-privilege operating-system account with constrained filesystem and process access.
• Add command logging, security alerts, rate limits, session expiration, and emergency token revocation.
• Require separate authentication or out-of-band confirmation before executing high-impact rescue operations.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:118

Finding

Primary Agent Credentials Duplicated into a Persistent Rescue Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 118-131
Vulnerability Type: Sensitive credential duplication across trust boundaries
Risk Level: High

Vulnerable Code

bash

cp ~/.openclaw/agents/main/agent/auth-profiles.json \
  ~/.openclaw-rescue/agents/rescue/agent/auth-profiles.json

chmod 600 ~/.openclaw-rescue/agents/rescue/agent/auth-profiles.json

Technical Analysis

The Skill directs users to copy the primary agent's complete authentication profile into the rescue agent directory. This duplicates sensitive provider credentials into a second environment that is persistent, Discord-connected, and configured for unrestricted command execution.

File mode 600 reduces access by other local users, but it does not protect the credentials from the rescue process itself, malicious commands executed under the same account, agent-level compromise, or accidental exposure through backups and logs. It also expands credential lifecycle complexity: both copies must be identified, rotated, and securely deleted after an incident.

Reusing the primary authentication profile violates credential isolation and least-privilege principles. The rescue agent should not automatically inherit every capability available to the primary agent.

Attack Path

1. The user copies auth-profiles.json from the primary agent into the rescue agent directory.
2. The rescue gateway runs persistently and can access the copied file under the same user account.
3. An attacker compromises the rescue gateway through its Discord channel, tokens, an unsafe plugin action, prompt injection, or unrestricted command execution.
4. The attacker reads the copied authentication profile or causes the gateway to use its credentials for unauthorized requests.
5. The attacker reuses exposed provider credentials outside the rescue environment until they are revoked or expire.

Impact Assessment

Compromise may expose all prov ...[truncated 448 chars]

Remediation

View remediation

Remediation Suggestions

• Do not copy the primary agent's complete auth-profiles.json into the rescue environment.
• Create separate rescue-specific credentials with minimal provider permissions, strict quotas, and a short lifetime.
• Store secrets in the operating system's credential manager or another approved secret store rather than duplicating plaintext credential files.
• Scope credentials to only the provider and model capabilities required for emergency operations.
• Implement automatic expiration and documented revocation and rotation procedures.
• Ensure backups exclude authentication material or protect it with appropriate encryption and access controls.
• Run the rescue service under a dedicated account that cannot read the primary agent's credential directory.
• Audit credential access and alert on unusual usage, source locations, request volume, or provider operations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly recommends a rescue gateway configuration with full execution privileges and no approval workflow, which removes an important safety boundary for command execution. In the context of a Discord-connected rescue bot, this materially increases the chance that unintended, malicious, or prompt-injected actions can execute on the host without human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The sample configuration disables exec prompts and sets plugin permission mode to approve-all, normalizing unrestricted execution as the baseline deployment pattern. Because this is a networked gateway tied to Discord, the lack of review for destructive or privacy-sensitive actions creates a strong path to host compromise, data loss, or abuse of local credentials and files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language instructions and description are entirely in Chinese, and the file does not indicate that the locale is optional or that the skill is restricted to a Chinese-speaking environment. Under the stated policy, forcing a specific language without opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions tell users to copy auth-profiles.json from the main agent into the rescue agent directory, duplicating sensitive authentication material on disk. That expands the credential exposure surface and can unintentionally grant the rescue instance access to provider accounts or secrets beyond what is necessary, especially if the rescue environment is less hardened.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

cp ~/.openclaw/agents/main/agent/auth-profiles.json
~/.openclaw-rescue/agents/rescue/agent/auth-profiles.json

chmod 600 ~/.openclaw-rescue/agents/rescue/agent/auth-profiles.json

text

## Rescue LaunchAgent

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

不要用官方默认 profile service label。

使用自定义 plist：

- 路径：`~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist`
- label：`ai.openclaw.gateway.rescue`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

不要用官方默认 profile service label。

使用自定义 plist：

- 路径：`~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist`
- label：`ai.openclaw.gateway.rescue`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

不要用官方默认 profile service label。

使用自定义 plist：

- 路径：`~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist`
- label：`ai.openclaw.gateway.rescue`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

不要用官方默认 profile service label。

使用自定义 plist：

- 路径：`~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist`
- label：`ai.openclaw.gateway.rescue`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md

不要用官方默认 profile service label。

使用自定义 plist：

- 路径：`~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist`
- label：`ai.openclaw.gateway.rescue`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

bash

launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist
launchctl enable gui/$(id -u)/ai.openclaw.gateway.rescue
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway.rescue

Static analysis

No suspicious patterns detected.