Service Persistence

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.1.0

Overview

The skill is openly about keeping macOS services running, but it includes a persistent remote Claude/Telegram agent that bypasses approval controls and auto-accepts a trust prompt.

Install only if you intentionally want this machine to create user-level macOS autorun services. Before use, remove Claude permission-bypass flags, disable automatic trust confirmation, restrict Telegram/channel access, prefer localhost bindings for development services, validate registry values before generating scripts, and document how to unload each LaunchAgent and stop related tmux sessions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/restore-claude-telegram.sh:7

Finding

Persistent Remote AI Agent Runs with Permission Controls Disabled

Content

View full analysis

0 )); then log "claude recovered (was at attempt $fail_count)" fi fail_count=0 else fail_count=$((fail_count + 1)) if (( fail_count > MAX_FAILURES )); then log "COOLDOWN: $MAX_FAILURES consecutive failures, sleeping 1 hour before retry" log "Manual restart: tmux new-session -d -s $SESSION -c $WORKDIR && tmux send-keys -t $SESSION '$CLAUDE_CMD' Enter" sleep 3600 fail_count=0 log "cooldown over, resuming monitor" continue fi start_claude continue fi sleep "$CHECK_INTERVAL" done ``` The documented LaunchAgent wrapper uses: ```xml RunAtLoad KeepAlive ``` ### Technical Analysis The wrapper launches Claude with both `--dangerously-skip-permissions` and `--permission-mode bypassPermissions`. These options explicitly remove interactive authorization barriers that would otherwise constrain filesystem access and command execution. The same command enables a Telegram channel, creating a remote input path into the agent. The wrapper continuously monitors the process and restarts it after termination, while the prescribed LaunchAgent configuration starts the wrapper at login and relaunches it if the wrapper exits. Service persistence is the declared purpose of the Skill, and a user-level LaunchAgent is relevant to that pur ...[truncated 1704 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/restore-claude-telegram.sh:29

Finding

Background Wrapper Automatically Accepts Workspace Trust Prompt

Content

View full analysis

/dev/null || echo "") if echo "$pane_out" | grep -q "trust this folder"; then log "trust prompt detected, confirming..." tmux send-keys -t "$SESSION" Enter sleep 10 fi ``` The generic wrapper repeats the same behavior: ```bash # Handle trust/confirmation prompts local pane_out pane_out=$(tmux capture-pane -pt "$SESSION:0.0" 2>/dev/null || echo "") if echo "$pane_out" | grep -q "trust this folder"; then log "trust prompt detected, confirming..." tmux send-keys -t "$SESSION" Enter sleep 10 fi ``` ### Technical Analysis Workspace trust prompts are security boundaries intended to require a human decision before an agent processes a directory and potentially follows directory-controlled configuration or instructions. The wrapper searches terminal output for a text fragment and sends Enter without validating the directory, prompt state, ownership, or expected action. This is also brittle terminal automation: the selected default option can change across versions, localized prompts may differ, and unrelated terminal content can contain the matching phrase. Consequently, the wrapper can approve an unintended prompt or trust a directory that has been replaced or modified since its original review. ### Attack Path 1. An attacker with local write access, a compromised synchronization process, or another compromised user process replaces or alters the configured workspace. 2. The persistent wrapper restarts Claude in that workspace. 3. Claude displays a trust prompt because the directory is new or its trust state changed. 4. The wrapper detects the text ...[truncated 768 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/bootstrap-template.md:17

Finding

Unescaped Registry Values Are Embedded into Persistent Shell Commands

Content

View full analysis

/dev/null; then log "skip $session (already running)" return fi tmux -S "$SOCKET" new-session -d -s "$session" "$cmd" log "started $session" } {{#SERVICES}} start_session "{{SESSION}}" "cd {{WORKDIR}} && {{COMMAND}}" {{/SERVICES}} ``` The wrapper template constructs another shell command from template values: ```bash SESSION="{{SESSION_NAME}}" WORKDIR="{{WORKDIR}}" COMMAND='{{COMMAND}}' ``` ```bash start_service() { tmux kill-session -t "$SESSION" 2>/dev/null || true sleep 1 tmux new-session -d -s "$SESSION" -c "$WORKDIR" sleep 2 tmux send-keys -t "$SESSION" "cd $WORKDIR && $COMMAND" Enter ``` The registry specification defines `workdir` and `command` as ordinary strings, but it does not prescribe validation, escaping, or trusted provenance. ### Technical Analysis Template values are interpolated directly inside shell-quoted source code. A value containing quote characters, command substitutions, shell separators, redirections, or newlines can terminate the intended quoting context and add arbitrary commands to the generated script. Even when the generated source remains syntactically intact, `tmux send-keys` deliberately places a composed string into an interactive shell. As a result, shell metacharacters inside `WORKDIR` or `COMMAND` are interpreted as executable syntax. The project does not include the registry file or a generator, so there is no evidence that an attacker currently controls these values. The vulnerability exists in the documented generation pattern and becomes exploitable if registry or template i ...[truncated 1300 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bootstrap-services.sh:40

Finding

Persistent Bootstrap Exposes Development Servers on All Network Interfaces

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The restore script is supposed to provide service persistence, but it launches Claude with --dangerously-skip-permissions --permission-mode bypassPermissions, which removes normal safety and authorization checks. In a persistence wrapper, this is especially dangerous because it creates an automatically restarting, unattended agent with elevated autonomy that can keep operating after reboot without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script both disables Claude's permission checks and automatically presses Enter when a "trust this folder" prompt appears, eliminating two layers of user consent. Because this logic is embedded in a watchdog loop that restarts the session after failure and after reboot, any unsafe behavior can be re-established persistently and without human intervention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and all operational guidance are written in Traditional Chinese, effectively imposing a language requirement on users without any opt-in or alternative locale. The policy for this audit flags language/locale constraints when the skill does not explicitly offer a user choice or document a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This skill is explicitly designed to establish service persistence on macOS via LaunchAgents, tmux bootstrap, and wrapper daemons. Persistence mechanisms are dual-use: legitimate for service recovery, but they also provide a durable foothold that would survive reboots and make unauthorized processes harder to remove if abused.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

│ └── restore-claude-telegram.sh ← 實際在跑的 Tier 3 wrapper daemon script └── references/ ├── registry-spec.md ← service-registry.json 格式規格 ├── launchagent-template.md ← plist 模板（3 種） ├── bootstrap-template.md ← bootstrap script 通用模板 └── wrapper-template.md ← wrapper daemon 通用模板

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Deploying scripts into ~/.openclaw/scripts and plist files into ~/Library/LaunchAgents operationalizes persistence in standard macOS autostart locations. In context, this makes the skill more dangerous because it provides concrete deployment paths that can be used to automatically relaunch software after login or reboot.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

**實際部署位置**：
- script 部署到 `~/.openclaw/scripts/`（LaunchAgent 引用的路徑）
- plist 部署到 `~/Library/LaunchAgents/`
- registry 在 `~/.openclaw/workspace/service-registry.json`

修改 skill 裡的 script 後，必須同步複製到部署位置。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The documented use of KeepAlive:true intentionally configures automatic restart when processes exit. While appropriate for reliability engineering, this increases persistence strength and resilience, which can be misused to maintain unwanted processes despite termination attempts.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- `KeepAlive: true` → process 掛掉自動重拉
- macOS 有內建 backoff，不會無限每秒重啟

**plist 模板**：見 `references/launchagent-template.md`

### Tier 2：tmux + bootstrap script（應用服務）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The Tier 3 checklist describes building a wrapper daemon that recreates sessions when killed and detects when the pane process has fallen back to a shell, then relaunches the program. This is more dangerous than simple boot persistence because it adds active self-healing behavior, making removal and troubleshooting of unwanted workloads significantly harder.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

4. **確認 tmux socket**：預設 socket（人操作）還是 OpenClaw socket（agent 管）
5. **第一次手動啟動 + 確認 trust folder**：trust 是 per-directory 一次性的
6. **寫 wrapper script**：從 `references/wrapper-template.md` 改
7. **建 LaunchAgent plist**：`KeepAlive: true`
8. **測試 1：kill session → wrapper 自動重建**
9. **測試 2：kill 程式但 session 殘留 → wrapper 偵測 pane process 是 shell → 自動重建**
10. **更新 service-registry.json**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The explicit launchctl load step activates persistence immediately, converting configuration into a live autorun mechanism. In a benign admin context this supports recovery, but in an adversarial context it would be a straightforward persistence-enablement instruction.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

1. 判斷屬於哪個 Tier（見上方適用條件）
2. 在 `service-registry.json` 新增 entry
3. 根據 Tier：
   - Tier 1：從模板生成 plist → 部署到 `~/Library/LaunchAgents/` → `launchctl load`
   - Tier 2：更新 `scripts/bootstrap-services.sh` 加新 session → 複製到部署位置
   - Tier 3：走 Tier 3 建立 checklist（上方 11 步）
4. 測試

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The explicit launchctl load step activates persistence immediately, converting configuration into a live autorun mechanism. In a benign admin context this supports recovery, but in an adversarial context it would be a straightforward persistence-enablement instruction.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

1. 判斷屬於哪個 Tier（見上方適用條件）
2. 在 `service-registry.json` 新增 entry
3. 根據 Tier：
   - Tier 1：從模板生成 plist → 部署到 `~/Library/LaunchAgents/` → `launchctl load`
   - Tier 2：更新 `scripts/bootstrap-services.sh` 加新 session → 複製到部署位置
   - Tier 3：走 Tier 3 建立 checklist（上方 11 步）
4. 測試

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The upgrade path from tmux to LaunchAgent formalizes a move from session-based runtime management to OS-backed persistence. That migration increases durability and stealth of continued execution after reboot or logout, so it is security-relevant even if the stated purpose is operational resilience.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

### 升級服務（例如 tmux → LaunchAgent）

1. 修改 registry 中的 tier 和 type
2. 生成新 plist
3. 從 bootstrap script 移除該 session
4. kill tmux session
5. 部署 plist → `launchctl load`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

Using launchctl load as part of the upgrade flow immediately registers and enables the persistent service. This is dangerous in the security sense because it provides actionable instructions for turning a process into a reboot-resilient autorun item.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

2. 生成新 plist
3. 從 bootstrap script 移除該 session
4. kill tmux session
5. 部署 plist → `launchctl load`
6. 驗證
7. 更新恢復文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

Using launchctl load as part of the upgrade flow immediately registers and enables the persistent service. This is dangerous in the security sense because it provides actionable instructions for turning a process into a reboot-resilient autorun item.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

2. 生成新 plist
3. 從 bootstrap script 移除該 session
4. kill tmux session
5. 部署 plist → `launchctl load`
6. 驗證
7. 更新恢復文件

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document title and explanatory section are written entirely in Traditional Chinese, with no indication that the user can choose another language or that the locale is required for a region-specific purpose. This creates a language/locale policy concern because the skill appears to impose a specific language by default.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The file is explicitly a LaunchAgent persistence template for macOS services, including reboot recovery and automatic restart. Persistence mechanisms are dual-use: in legitimate admin tooling they are expected, but they also establish code execution at login and can be abused to maintain unauthorized footholds if untrusted programs or scripts are installed through these templates.

Content

Scanner excerpt · references/launchagent-template.md (reported line 1)May include surrounding context.

md

# LaunchAgent plist 模板

## 標準 daemon（Tier 1，KeepAlive）

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire template and operational instructions are written in Traditional Chinese, with no indication that users may choose another language or that the file is intentionally limited to a Chinese-speaking audience. Under the policy rule, imposing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

This plist template defines a standard KeepAlive LaunchAgent, which causes a program to run automatically and restart after termination. In context this is intended service management, but the capability is inherently persistence-enabling and dangerous if pointed at an attacker-controlled binary or a tampered path.

Content

Scanner excerpt · references/launchagent-template.md (reported line 7)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

This plist template defines a standard KeepAlive LaunchAgent, which causes a program to run automatically and restart after termination. In context this is intended service management, but the capability is inherently persistence-enabling and dangerous if pointed at an attacker-controlled binary or a tampered path.

Content

Scanner excerpt · references/launchagent-template.md (reported line 7)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 8)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 32)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 40)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 58)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 66)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 88)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 95)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchagent-template.md (reported line 108)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>{{LABEL}}</string>

Static analysis

No suspicious patterns detected.