ClawHub
Back to skill

Security audit

Gateway Guardian

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a gateway watchdog, but it silently sends alerts to a fixed Telegram account and can overwrite the active OpenClaw config without clear user control.

Review before installing or running. Only use this if you are comfortable editing the script first: remove or replace the hard-coded Telegram recipient, make notifications opt-in, and require validation or confirmation before it overwrites your OpenClaw config. Running it as-is may disclose gateway status to an unknown Telegram account and may replace your active OpenClaw configuration during recovery.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
guardian.sh:46
Finding

Undisclosed Telegram Notifications Sent to a Hard-Coded Recipient

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
guardian.sh:53
Finding

Unvalidated Backup Can Automatically Overwrite the Active Gateway Configuration

Content
View full analysis
/dev/null ``` The relevant paths are defined as: ```bash BACKUP_CONFIG="$HOME/.openclaw/openclaw.json.bak" CONFIG="$HOME/.openclaw/openclaw.json" ``` ### Technical Analysis When the diagnostic output contains `Config invalid`, the script treats the mere existence of `$HOME/.openclaw/openclaw.json.bak` as sufficient evidence that the file is safe and suitable for restoration. It then copies that file over the active configuration without: - Validating the backup before replacement. - Checking ownership, permissions, file type, or symbolic-link status. - Preserving the current configuration. - Confirming that the backup is newer or trusted. - Obtaining operator approval. - Performing an atomic replacement. The gateway is subsequently started using the restored configuration. Therefore, a stale, corrupted, or attacker-modified backup can become the active configuration. The script defines a `check_config` function, but that function is not used to validate the backup before it replaces the active file. This recovery behavior is also not disclosed in `SKILL.md`, which describes monitoring and restart functionality rather than destructive configuration restoration. ### Attack Path 1. A backup exists at `$HOME/.openclaw/openclaw.json.bak`. 2. An attacker who can write to that file, or a previous unsafe process, places modified OpenClaw settings in the backup. Alternatively, the backup is simply stale or corrupt. 3. The active configuration causes `openclaw doctor` to emit `Config invalid`. 4. The script enters its recovery branch. 5. `cp "$BACKUP_CONFIG" "$CONFIG"` overwrites the active configuration without preserving or validating it. 6. The scri ...[truncated 947 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Run as background daemon:

bash
nohup ./guardian.sh &

Features

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script’s stated purpose is limited to health checking and auto-recovery, but it also sends Telegram notifications to a hard-coded recipient ID. This hidden outbound messaging behavior creates an undisclosed data-flow and control path, which is risky in an agent skill because failures and operational state may be exfiltrated to an external party without user awareness or consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's comments and all user-facing log and alert messages are written in Chinese, including operational notifications sent to the user. This imposes a specific language/locale without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.