Auto Reboot Recovery

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Mac service recovery tool, but it persistently restarts a Telegram-connected Claude agent with permission checks disabled and exposes development services on all network interfaces.

Install only after reviewing every LaunchAgent and script that would be deployed. Remove the Claude permission-bypass flags, do not auto-confirm trust prompts, bind local dev servers to 127.0.0.1 unless remote access is intentionally secured, and keep clear unload/removal steps for each persistent service.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/restore-claude-telegram.sh:9

Finding

Persistent Telegram-Connected Claude Agent Runs with Permission Enforcement Disabled

Content

View full analysis

/dev/null || true sleep 1 tmux new-session -d -s "$SESSION" -c "$WORKDIR" sleep 2 tmux send-keys -t "$SESSION" "$CLAUDE_CMD" Enter log "sent claude command (workdir: $WORKDIR), waiting ${STARTUP_WAIT}s..." sleep "$STARTUP_WAIT" # Handle "trust this folder" prompt if it appears local pane_out pane_out=$(tmux capture-pane -pt "$SESSION:0.0" 2>/dev/null || echo "") if echo "$pane_out" | grep -q "trust this folder"; then log "trust prompt detected, confirming..." tmux send-keys -t "$SESSION" Enter sleep 10 fi log "started $SESSION" } ``` ```bash while true; do if is_claude_alive; then if (( fail_count > 0 )); then log "claude recovered (was at attempt $fail_count)" fi fail_count=0 else fail_count=$((fail_count + 1)) if (( fail_count > MAX_FAILURES )); then log "COOLDOWN: $MAX_FAILURES consecutive failures, sleeping 1 hour before retry" log "Manual restart: tmux new-session -d -s $SESSION -c $WORKDIR && tmux send-keys -t $SESSION '$CLAUDE_CMD' Enter" sleep 3600 fail_count=0 log "cooldown over, resuming monitor" continue fi start_claude continue fi sleep "$CHECK_INTERVAL" done ``` The documented LaunchAgent used to run this wrapper is persistent: ```xml ProgramArguments /bin/zsh {{WRAPPER_SCRIPT ...[truncated 2682 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bootstrap-services.sh:40

Finding

Persistent Development Services Bind to All Network Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/bootstrap-template.md:20

Finding

Registry-Derived Values Are Rendered into Executable Shell Commands Without Validation

Content

View full analysis

/dev/null; then log "skip $session (already running)" return fi tmux -S "$SOCKET" new-session -d -s "$session" "$cmd" log "started $session" } sleep {{BOOT_DELAY}} {{#SERVICES}} start_session "{{SESSION}}" "cd {{WORKDIR}} && {{COMMAND}}" {{/SERVICES}} ``` The wrapper template similarly constructs executable shell text: ```bash SESSION="{{SESSION_NAME}}" WORKDIR="{{WORKDIR}}" COMMAND='{{COMMAND}}' LOG="{{HOME}}/.openclaw/logs/{{LOG_PREFIX}}-wrapper.log" ``` ```bash start_service() { tmux kill-session -t "$SESSION" 2>/dev/null || true sleep 1 tmux new-session -d -s "$SESSION" -c "$WORKDIR" sleep 2 tmux send-keys -t "$SESSION" "cd $WORKDIR && $COMMAND" Enter ``` The registry specification defines unrestricted command-bearing fields: ```json { "name": "Service display name", "tier": 2, "type": "tmux-bootstrap", "session": "tmux session name", "socket": "openclaw", "port": 8124, "workdir": "/path/to/workdir", "command": "startup command", "description": "purpose" } ``` ```json { "name": "Service display name", "tier": 3, "type": "wrapper-daemon", "session": "tmux session name", "socket": "default", "workdir": "/path/to/workdir", "command": "command sent into tmux", "wrapper_label": "LaunchAgent label", "wrapper_script": "script path" } ``` ### Technical Analysis The templates place `SESSION`, `WORKDIR`, and `COMMAND` ...[truncated 2093 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (39)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script launches Claude with --dangerously-skip-permissions --permission-mode bypassPermissions, explicitly disabling normal permission controls for an automatically restarted background service. In a reboot-persistence skill, this materially increases risk because the agent will come back after restart with broad unchecked capabilities and no fresh user approval, enabling unauthorized actions if the service is misused or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script captures tmux output and automatically presses Enter when it detects a "trust this folder" prompt, bypassing any intentional user consent step. In this skill's persistence/recovery context, that behavior is more dangerous because it ensures a previously interactive trust decision is silently re-applied after reboot, allowing the agent to regain trusted access without user review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This section documents a wrapper daemon script specifically intended to restore interactive services after interruption, which is a persistence mechanism. In isolation this is legitimate administration guidance, but from a security perspective it enables user-level persistence that could be repurposed to keep unauthorized processes alive across reboots or crashes.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

│ └── restore-claude-telegram.sh ← 實際在跑的 Tier 3 wrapper daemon script └── references/ ├── registry-spec.md ← service-registry.json 格式規格 ├── launchagent-template.md ← plist 模板（3 種） ├── bootstrap-template.md ← bootstrap script 通用模板 └── wrapper-template.md ← wrapper daemon 通用模板

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to modify persistent startup configuration and deployed service scripts under LaunchAgents and user script directories, but it does not require an explicit confirmation or warning before making reboot-persistent changes. Because these actions survive reboots and can change long-lived system behavior, an agent following this skill could create unintended persistence or service breakage without the user's fully informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill gives concrete deployment paths for persistence artifacts, including ~/Library/LaunchAgents/ and a user script directory referenced by LaunchAgent. That makes the persistence operational rather than merely conceptual, increasing the chance that an agent can install or modify auto-start behavior directly and durably.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

**實際部署位置**：
- script 部署到 `~/.openclaw/scripts/`（LaunchAgent 引用的路徑）
- plist 部署到 `~/Library/LaunchAgents/`
- registry 在 `~/.openclaw/workspace/service-registry.json`

修改 skill 裡的 script 後，必須同步複製到部署位置。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Referencing a LaunchAgent plist template in the context of KeepAlive: true describes an auto-restart persistence mechanism. This is more dangerous than simple session recovery because it can continuously resurrect a process after termination, making accidental or unauthorized persistence harder to notice and remove.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- `KeepAlive: true` → process 掛掉自動重拉
- macOS 有內建 backoff，不會無限每秒重啟

**plist 模板**：見 `references/launchagent-template.md`

### Tier 2：tmux + bootstrap script（應用服務）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The checklist explicitly instructs creation of a KeepAlive: true LaunchAgent for a wrapper that monitors and rebuilds sessions, which is a durable self-healing persistence pattern. The added logic to detect dead pane processes and recreate them makes the mechanism more resilient and therefore more abusable if pointed at an unsafe command.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

5. **確認 tmux socket**：預設 socket（人操作）還是 OpenClaw socket（agent 管）
6. **第一次手動啟動 + 確認 trust folder**：trust 是 per-directory 一次性的
7. **寫 wrapper script**：從 `references/wrapper-template.md` 改，PATH 必須包含所有依賴 binary
8. **建 LaunchAgent plist**：`KeepAlive: true`
9. **測試 1：kill session → wrapper 自動重建**
10. **測試 2：kill 程式但 session 殘留 → wrapper 偵測 pane process 是 shell → 自動重建**
11. **測試 3：確認 plugin subprocess 也在跑**（如 `ps aux | grep bun`）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The explicit launchctl load step activates persistence immediately, making the change live without an additional human review stage. If the persisted command is misconfigured or malicious, it will start automatically and may continue across future logins or reboots.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

1. 判斷屬於哪個 Tier（見上方適用條件）
2. 在 `service-registry.json` 新增 entry
3. 根據 Tier：
   - Tier 1：從模板生成 plist → 部署到 `~/Library/LaunchAgents/` → `launchctl load`
   - Tier 2：更新 `scripts/bootstrap-services.sh` 加新 session → 複製到部署位置
   - Tier 3：走 Tier 3 建立 checklist（上方 11 步）
4. 測試

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The explicit launchctl load step activates persistence immediately, making the change live without an additional human review stage. If the persisted command is misconfigured or malicious, it will start automatically and may continue across future logins or reboots.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

1. 判斷屬於哪個 Tier（見上方適用條件）
2. 在 `service-registry.json` 新增 entry
3. 根據 Tier：
   - Tier 1：從模板生成 plist → 部署到 `~/Library/LaunchAgents/` → `launchctl load`
   - Tier 2：更新 `scripts/bootstrap-services.sh` 加新 session → 複製到部署位置
   - Tier 3：走 Tier 3 建立 checklist（上方 11 步）
4. 測試

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The upgrade workflow from tmux to LaunchAgent instructs migration into a more persistent and autonomous execution model. Converting an existing service into LaunchAgent-managed autostart increases the security impact because the process will no longer depend on a manually maintained terminal session.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

### 升級服務（例如 tmux → LaunchAgent）

1. 修改 registry 中的 tier 和 type
2. 生成新 plist
3. 從 bootstrap script 移除該 session
4. kill tmux session
5. 部署 plist → `launchctl load`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The launchctl load command in the migration flow immediately enables the newly created LaunchAgent, which operationalizes persistence on the host. In a benign admin skill this may be expected, but it remains security-relevant because it can be abused for stealthy user-level autostart and rapid reactivation of processes.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

2. 生成新 plist
3. 從 bootstrap script 移除該 session
4. kill tmux session
5. 部署 plist → `launchctl load`
6. 驗證
7. 更新恢復文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The launchctl load command in the migration flow immediately enables the newly created LaunchAgent, which operationalizes persistence on the host. In a benign admin skill this may be expected, but it remains security-relevant because it can be abused for stealthy user-level autostart and rapid reactivation of processes.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

2. 生成新 plist
3. 從 bootstrap script 移除該 session
4. kill tmux session
5. 部署 plist → `launchctl load`
6. 驗證
7. 更新恢復文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The document is explicitly a LaunchAgent template for auto-starting services after login/reboot, which implements macOS persistence. Persistence mechanisms are dual-use: legitimate for service recovery, but also commonly abused to maintain unauthorized code execution across reboots.

Content

Scanner excerpt · references/launchagent-template.md (reported line 1)May include surrounding context.

md

# LaunchAgent plist 模板

## 標準 daemon（Tier 1，KeepAlive）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The matched PLIST content is part of a reusable LaunchAgent persistence definition. Even though it is documentation, it directly teaches and enables a standard macOS persistence mechanism, which elevates risk in an agent skill meant to restore services after reboot.

Content

Scanner excerpt · references/launchagent-template.md (reported line 7)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The matched PLIST content is part of a reusable LaunchAgent persistence definition. Even though it is documentation, it directly teaches and enables a standard macOS persistence mechanism, which elevates risk in an agent skill meant to restore services after reboot.

Content

Scanner excerpt · references/launchagent-template.md (reported line 7)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The plist body includes the configuration structure used to register autorun services. As presented, it enables unattended startup behavior and therefore constitutes a true persistence-related capability, though the intent in this file appears operational rather than malicious.

Content

Scanner excerpt · references/launchagent-template.md (reported line 8)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This section closes one LaunchAgent template and introduces a bootstrap/restore trigger, continuing the persistence pattern. One-shot startup triggers are still security-relevant because they can execute code automatically at login/load time without further user action.

Content

Scanner excerpt · references/launchagent-template.md (reported line 32)May include surrounding context.

Comment {{DESCRIPTION}}

text

## 一次性腳本（bootstrap / restore 觸發器）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The PLIST declaration here supports an automatic restore/bootstrap action. In a recovery skill this is expected, but it still exposes a persistence mechanism that could be misused to run arbitrary code at session start.

Content

Scanner excerpt · references/launchagent-template.md (reported line 39)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The PLIST declaration here supports an automatic restore/bootstrap action. In a recovery skill this is expected, but it still exposes a persistence mechanism that could be misused to run arbitrary code at session start.

Content

Scanner excerpt · references/launchagent-template.md (reported line 39)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The plist content at this location belongs to an autorun trigger configuration. Because it facilitates execution at load time, it is a genuine persistence-related security concern despite the likely benign maintenance intent.

Content

Scanner excerpt · references/launchagent-template.md (reported line 40)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This marks the end of the one-shot autorun template and transition to a wrapper daemon section, both of which remain within the persistence domain. Wrapper and restore mechanisms can obscure the actual executed payload and make unauthorized persistence harder to notice.

Content

Scanner excerpt · references/launchagent-template.md (reported line 58)May include surrounding context.

StandardErrorPath {{HOME}}/.openclaw/logs/{{LOG_PREFIX}}.err.log

text

## Wrapper daemon（Tier 3，KeepAlive = true 但跑的是 wrapper script）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The PLIST declaration is part of a wrapper-based persistent service pattern. In context, the skill is specifically about auto-restart recovery, which makes this more operationally justified but also more dangerous because it normalizes durable execution mechanisms.

Content

Scanner excerpt · references/launchagent-template.md (reported line 65)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The PLIST declaration is part of a wrapper-based persistent service pattern. In context, the skill is specifically about auto-restart recovery, which makes this more operationally justified but also more dangerous because it normalizes durable execution mechanisms.

Content

Scanner excerpt · references/launchagent-template.md (reported line 65)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The plist body here supports a KeepAlive wrapper daemon, which will repeatedly launch a shell script. A shell-based persistent launcher broadens attack surface because compromise of the script or its environment can yield stealthy recurring execution.

Content

Scanner excerpt · references/launchagent-template.md (reported line 66)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This closes the wrapper daemon template but remains part of the documented persistence mechanism. The overall file provides sufficient detail to install recurring startup execution, so the persistence concern remains valid here as well.

Content

Scanner excerpt · references/launchagent-template.md (reported line 88)May include surrounding context.

Comment {{DESCRIPTION}}

text

## 安裝流程

Static analysis

No suspicious patterns detected.