continuous-openclaw-config-guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:34 PM UTC
• Version: 1.0.1

Overview

This skill mostly does what it claims, but it also sends undisclosed status messages to a hard-coded Matrix room/account while running as a persistent guard.

Install only after reviewing and editing the service file and guard.sh. Remove or disable the hard-coded Matrix message sends unless you intentionally want those notifications, run the service under the least-privileged user possible, and avoid enabling boot persistence until the paths, account, rollback behavior, and stop logic are validated.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/guard.sh:186

Finding

Undisclosed outbound notifications to a hard-coded Matrix room and account

Content

View full analysis

> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启失败 -> 回滚至稳定版本，回归正常监控" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证 -> 消息验证通过 -> 新配置已备份，回归正常监控" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证 -> 超时未检测到消息 (${WAIT_TIME}s)，判定为故障配置 -> 回滚至稳定版本，回归正常监控" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证 -> 验证监控中: 已耗时 ${ELAPSED}s，剩余 ${REMAINING}s..." --account huoxiaoxing >> "$LOG_FILE" 2>&1 ``` ### Technical Analysis The guard sends configuration-change, gateway-status, validation, timeout, and rollback events to the fixed Matrix room `!HwJBqEutNMXtWGuTAa:matrix.local` through the fixed account `huoxiaoxing`. The declared rollback functionality only requires local file monitoring, backup management, gateway control, and session-activity checks. Sending these events to a developer-specific destination is not necessary for those operations. The documentation does not disclose this outbound behavior or require the user to review and replace the destination. No configuration contents, credentials, or private keys are visibly included in these messages. Nevertheless, the messages disclose operational metadata, including configuration-change timing, gate ...[truncated 1512 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/guard.sh:129

Finding

Overbroad process termination through command-line pattern matching

Content

View full analysis

/dev/null && log "守护进程已停止" ``` ### Technical Analysis When the PID file is unavailable, the stop operation falls back to `pkill -f`. The `-f` option matches against complete process command lines rather than a verified process identity. The pattern `guard.sh -s` is generic and is not tied to the installed script's canonical path, process owner beyond the command's effective user, expected working directory, or a unique daemon instance. Consequently, every accessible process with a matching command-line fragment may be terminated. An unrelated guard instance can be stopped accidentally. A local process can also deliberately include the matching text in its command line and become a termination target. This is an availability and process-management flaw rather than a privilege-escalation primitive. ### Attack Path 1. The guard's PID file is missing, deleted, stale, or stored at an incorrect path. 2. A user or service invokes `guard.sh -k`, including through the systemd `ExecStop` operation. 3. The script executes `pkill -f "guard.sh -s"`. 4. All processes visible to the effective user whose command lines match that fragment receive a termination signal. 5. Unrelated matching processes or other instances of the guard may be stopped. An attacker would need the ability to remove or influence the PID file, trigger the stop operation, or arrange for a same-user process to have a matching command line. The code does not allow termination of processes that the effective user is otherwise prohibited from signaling. ### Impact Assessment The maximum direct privilege remains that of the user running the script; this issue does not independently grant elevated privileges. Its impact is denial of service against matching processes owned by or otherwise signalabl ...[truncated 390 chars]

Remediation

View remediation

/exe` or `/proc//cmdline` against the canonical script path and expected arguments. 5. Remove stale PID files only after identity verification fails. 6. Add signal handling so the daemon removes its PID file on normal exit: ```bash cleanup() { rm -f -- "$PID_FILE" } trap cleanup EXIT INT TERM ``` 7. Use a dedicated user-level systemd service where possible, avoiding custom PID-based stopping altogether. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The main skill documentation from the title onward is written entirely in Chinese, and the file does not offer an alternate language option or ask for user preference. This can violate organizational language/locale policy when a skill imposes a specific language without opt-in, especially since the skill name and metadata are otherwise not region-scoped.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md

nano ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt

# 3. 复制服务文件到 systemd 目录
sudo cp ~/.openclaw/workspace/skills/continuous-openclaw-config-guard/scripts/continuous-openclaw-config-guard.service.txt /etc/systemd/system/continuous-openclaw-config-guard.service

# 4. 重新加载 systemd
sudo systemctl daemon-reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

Enabling the service at boot creates persistence for a script that monitors and modifies configuration, restarts the gateway, and can roll back files automatically. Persistence increases the blast radius of any bug, misconfiguration, or later tampering with the script or its referenced paths, because the behavior will recur automatically across reboots.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

sudo systemctl status continuous-openclaw-config-guard

7. 开机自启（可选）

sudo systemctl enable continuous-openclaw-config-guard

text

#### 管理服务（仅启动/停止/重启）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The documentation explicitly recommends enabling the guard as a boot-persistent service. Persistence is security-relevant because the skill is designed to continuously monitor files, restart a gateway, and perform rollback actions automatically; if the script, service unit, or configured paths are later altered, the system will repeatedly execute that behavior after every reboot.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

sudo systemctl status continuous-openclaw-config-guard

7. 开机自启（可选）

sudo systemctl enable continuous-openclaw-config-guard

text

#### 管理服务（仅启动/停止/重启）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash

# 启动守护进程
sudo systemctl start continuous-openclaw-config-guard

# 停止守护进程
sudo systemctl stop continuous-openclaw-config-guard

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

bash

# 启动守护进程
sudo systemctl start continuous-openclaw-config-guard

# 停止守护进程
sudo systemctl stop continuous-openclaw-config-guard

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

bash

# 启动守护进程
sudo systemctl start continuous-openclaw-config-guard

# 停止守护进程
sudo systemctl stop continuous-openclaw-config-guard

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

bash

# 启动守护进程
sudo systemctl start continuous-openclaw-config-guard

# 停止守护进程
sudo systemctl stop continuous-openclaw-config-guard

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

bash

# 启动守护进程
sudo systemctl start continuous-openclaw-config-guard

# 停止守护进程
sudo systemctl stop continuous-openclaw-config-guard

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

bash

# 启动守护进程
sudo systemctl start continuous-openclaw-config-guard

# 停止守护进程
sudo systemctl stop continuous-openclaw-config-guard

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends outbound Matrix messages containing operational events about configuration changes, restart success/failure, validation progress, and rollback actions. This creates an undocumented data egress channel beyond the core backup/monitor/restart behavior and can leak sensitive system state or administrative activity to an external recipient if the room, account, or server is misconfigured or untrusted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script transmits alerts about config modification, gateway restart outcome, timeout-based validation failure, and ongoing session-related monitoring without any explicit consent or user-facing disclosure in the script's behavior. Even if the payloads are short, they reveal sensitive operational telemetry and indicate when configuration and session activity changes occur, which may expose administrative actions or system health to third parties.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The unit description at L02 presents the service as a configuration rollback guardian, implying protective behavior. However, this file only defines systemd execution of guard.sh for start/stop and contains no in-file logic demonstrating rollback or guarding behavior, creating an intent-documentation mismatch at the file level.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comments at L07, L14, L16, and L19 are written as imperative instructions in Chinese, which imposes a specific language on operators without offering any alternative or opt-in. This is a natural-language locale policy issue because the file provides operational guidance only in one language with no documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script's comments, help text, logs, and user-visible error/output strings are written in Chinese only. This imposes a specific language on users without any opt-in, fallback, or documented locale justification.

Content

No source excerpt is available for this finding.