Gateway Guardian

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:34 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a gateway watchdog, but it silently sends alerts to a fixed Telegram account and can overwrite the active OpenClaw config without clear user control.

Review before installing or running. Only use this if you are comfortable editing the script first: remove or replace the hard-coded Telegram recipient, make notifications opt-in, and require validation or confirmation before it overwrites your OpenClaw config. Running it as-is may disclose gateway status to an unknown Telegram account and may replace your active OpenClaw configuration during recovery.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: guardian.sh:46
• Finding: Undisclosed Telegram Notifications Sent to a Hard-Coded Recipient<![CDATA[ ## Vulnerability Details **File Location**: `guardian.sh`, lines 46-47, 62-63, 66-67, and 71-72 **Vulnerability Type**: Hard-coded external notification recipient **Risk Level**: Medium ### Vulnerable Code The same hard-coded recipient is used in four notification branches: ```bash openclaw message send --channel telegram --to "7533987198" \ ``` ### Technical Analysis The script uses OpenClaw's authenticated messaging capability to send gateway availability and recovery information to the fixed Telegram account `7533987198`. The recipient is embedded directly in the script and cannot be configured by the operator. This external communication is not disclosed in `SKILL.md`. Consequently, an operator may run the guardian expecting only local health checks and gateway restarts while the script transmits operational information to an account that may be controlled by the package author or another unknown party. No authentication secret is directly exposed by the script, and the alert messages do not contain configuration contents. Nevertheless, the hard-coded destination creates an unauthorized information-disclosure channel and can redirect alerts away from the legitimate system owner. ### Attack Path 1. A user runs `guardian.sh` in an environment where OpenClaw has an authenticated Telegram channel. 2. The local gateway on port `18789` becomes unavailable. 3. The script attempts to restart or recover the gateway. 4. A restart succeeds after configuration recovery, fails after recovery, or cannot be attempted because no backup exists. 5. The script invokes `openclaw message send` using the existing OpenClaw messaging privileges. 6. Gateway status and recovery information are transmitted to Telegram account `7533987198` without the operator selecting or approving that recipient. ### Impact Assessment The script can exercise the Telegram messaging privileges already available to the executing OpenClaw user. An unknown recipient can learn that the ...[truncated 340 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the hard-coded Telegram account identifier. - Disable external notifications by default. - Accept the destination through an explicitly documented environment variable or protected configuration field, such as `GUARDIAN_TELEGRAM_RECIPIENT`. - Validate that the configured destination belongs to the operator before enabling notifications. - Clearly document every outbound communication channel and the information transmitted. - Log notification failures locally without silently redirecting messages to a fallback recipient. - Consider requiring an explicit command-line option such as `--enable-notifications` before using OpenClaw's messaging capability. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: guardian.sh:53
• Finding: Unvalidated Backup Can Automatically Overwrite the Active Gateway Configuration<![CDATA[ ## Vulnerability Details **File Location**: `guardian.sh`, lines 53-57 **Vulnerability Type**: Unsafe configuration restoration and destructive file replacement **Risk Level**: Medium ### Vulnerable Code ```bash if [ -f "$BACKUP_CONFIG" ]; then cp "$BACKUP_CONFIG" "$CONFIG" openclaw gateway start 2>/dev/null ``` The relevant paths are defined as: ```bash BACKUP_CONFIG="$HOME/.openclaw/openclaw.json.bak" CONFIG="$HOME/.openclaw/openclaw.json" ``` ### Technical Analysis When the diagnostic output contains `Config invalid`, the script treats the mere existence of `$HOME/.openclaw/openclaw.json.bak` as sufficient evidence that the file is safe and suitable for restoration. It then copies that file over the active configuration without: - Validating the backup before replacement. - Checking ownership, permissions, file type, or symbolic-link status. - Preserving the current configuration. - Confirming that the backup is newer or trusted. - Obtaining operator approval. - Performing an atomic replacement. The gateway is subsequently started using the restored configuration. Therefore, a stale, corrupted, or attacker-modified backup can become the active configuration. The script defines a `check_config` function, but that function is not used to validate the backup before it replaces the active file. This recovery behavior is also not disclosed in `SKILL.md`, which describes monitoring and restart functionality rather than destructive configuration restoration. ### Attack Path 1. A backup exists at `$HOME/.openclaw/openclaw.json.bak`. 2. An attacker who can write to that file, or a previous unsafe process, places modified OpenClaw settings in the backup. Alternatively, the backup is simply stale or corrupt. 3. The active configuration causes `openclaw doctor` to emit `Config invalid`. 4. The script enters its recovery branch. 5. `cp "$BACKUP_CONFIG" "$CONFIG"` overwrites the active configuration without preserving or validating it. 6. The scri ...[truncated 947 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make automatic configuration restoration opt-in and document the behavior prominently. - Validate the backup with the supported OpenClaw configuration checker before modifying the active file. - Verify that the backup is a regular file, is not a symbolic link, is owned by the expected user, and is not writable by group or other users. - Preserve the current configuration under a timestamped recovery name before replacement. - Copy the backup to a securely created temporary file in the same directory, validate it, set restrictive permissions, and use an atomic rename. - Compare backup metadata or a previously recorded cryptographic hash against an operator-approved value. - Refuse restoration when the backup is stale, malformed, unexpectedly owned, or has unsafe permissions. - Require interactive confirmation unless the operator has explicitly enabled unattended recovery. - If gateway startup fails, restore the preserved configuration rather than leaving the unvalidated backup active. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

Run as background daemon:
```bash
nohup ./guardian.sh &
```

## Features

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The script’s stated purpose is limited to health checking and auto-recovery, but it also sends Telegram notifications to a hard-coded recipient ID. This hidden outbound messaging behavior creates an undisclosed data-flow and control path, which is risky in an agent skill because failures and operational state may be exfiltrated to an external party without user awareness or consent.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's comments and all user-facing log and alert messages are written in Chinese, including operational notifications sent to the user. This imposes a specific language/locale without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific environment.

Static analysis

No suspicious patterns detected.