T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:4- Finding
Mutable Remote Application and Dependencies Are Executed Without Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Security audit
LuLu Monitor
Security checks for vulnerabilities and agentic risk
Overview
This skill is a firewall companion, but installation fetches and persistently runs unaudited remote code with broad local permissions and optional automatic firewall approvals.
Install only if you are comfortable with a persistent macOS LaunchAgent running code pulled from the publisher's GitHub repository at install time. Review or pin the remote repository first, avoid enabling autoExecute or permanent auto-allow rules, and understand that granting Accessibility to Terminal or osascript and enabling sessions_spawn gives this integration broad local control.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T06 · System Persistence
Error
- Location
scripts/install.sh:44- Finding
Downloaded Application Is Registered as an Automatically Restarting LaunchAgent
- Content
View full analysis
"$LAUNCH_AGENTS/$PLIST_NAME" << EOF Label com.openclaw.lulu-monitor ProgramArguments $(which node) $INSTALL_DIR/src/index.js --verbose RunAtLoad KeepAlive StandardOutPath $INSTALL_DIR/logs/stdout.log StandardErrorPath $INSTALL_DIR/logs/stderr.log WorkingDirectory $INSTALL_DIR EnvironmentVariables PATH /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$(dirname $(which node)) EOF echo "" echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" ``` ### Technical Analysis The installer writes a LaunchAgent under `~/Library/LaunchAgents`, enables `RunAtLoad`, enables `KeepAlive`, and immediately loads the service. This causes the downloaded Node.js application to start automatically and be restarted when it terminates. Continuous background execution is related to the declared firewall-monitoring functionality, and the behavior is documented in `SKILL.md`. However, it creates cross-session persistence and is not an appropriate minimum-risk default when the service target is fetched from a mutable external source and is absent from the audited package. `KeepAlive` also m ...[truncated 1145 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:52- Finding
Broad Accessibility and Agent-Session Permissions Expand the Persistent Payload's Authority
- Content
View full analysis
Privacy > Accessibility > Enable Terminal/osascript ### Gateway Configuration (Required) The monitor calls `sessions_spawn` via OpenClaw's `/tools/invoke` HTTP API. This tool is blocked by default. Add it to the allowlist in `~/.openclaw/openclaw.json`: ```json5 { "gateway": { "tools": { "allow": ["sessions_spawn"] } } } ``` ``` The troubleshooting section reinforces the broad Accessibility grant: ```markdown ### Accessibility permission issues AppleScript needs permission to control LuLu. Go to: System Settings > Privacy & Security > Accessibility Enable: Terminal, iTerm, or whatever terminal you use ``` ### Technical Analysis The Skill instructs users to grant Accessibility access to a general-purpose terminal or `osascript` environment. Accessibility access is powerful UI-automation authority and is not inherently limited to the LuLu application. Granting it to Terminal can consequently benefit unrelated scripts and commands launched from that terminal. The Skill also asks users to unblock `sessions_spawn`, which is explicitly disabled by default. The permission appears functionally related to AI analysis, but it is broader than a purpose-specific firewall-alert analysis operation. These capabilities are especially significant because the application that uses them is not included in the audited package and is downloaded from a mutable branch. The reviewed files do not prove direct abuse of these permissions, but the design substantially increases the impact of a compromised ef ...[truncated 1064 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/configure.sh:25- Finding
Telegram Identifier Is Written to JSON Without Validation or Escaping
- Content
View full analysis
"$CONFIG_FILE" << EOF { "telegramId": "$NEW_TG_ID" } EOF echo "" echo "✅ Configuration saved!" ``` ### Technical Analysis The script directly interpolates terminal input into a JSON string without validating that the value is a Telegram numeric identifier or escaping JSON metacharacters. Input containing a quote, backslash, or newline can produce malformed JSON. A crafted value may also introduce additional JSON properties if the resulting content is accepted by the downstream parser. The input is not evaluated as a shell command, so the reviewed code does not demonstrate shell-command injection. The principal risks are configuration corruption and unintended manipulation of downstream configuration semantics. The file is also written without explicitly establishing restrictive permissions or using an atomic replacement operation. ### Attack Path 1. A local user or an operator following attacker-supplied instructions enters a crafted Telegram identifier containing JSON syntax. 2. The here-document inserts the value verbatim into `config.json`. 3. The configuration becomes malformed or contains attacker-influenced additional fields. 4. The service restarts and attempts to parse or act on the altered configuration. 5. Depending on the unseen application's parser and accepted properties, the result may range from denial of service to configuration manipulation. ### Impact Assessment The confirmed impact is corruption of `config.json` and potential failure of the monitor to restart correctly. Additional property injection is structurally possible, but its ultimate security impact cannot be established because the applicati ...[truncated 147 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Generate JSON with a real serializer, such as Node.js, Python, or `jq`, rather than string interpolation. 3. Set `umask 077` before creating configuration files. 4. Write to a temporary file in the same directory, validate the generated JSON, and atomically rename it into place. 5. Preserve existing supported configuration fields instead of replacing the complete file when only `telegramId` changes. 6. Refuse to restart the service unless the resulting configuration passes strict schema validation. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents an operational firewall-monitoring and AI/Telegram integration skill, but the provided code does not monitor firewall alerts, analyze connections, send notifications, or handle LuLu callbacks. Instead, it is purely an uninstall utility for removing the LuLu Monitor service and related files. This is a materially different primary purpose and includes filesystem/service-removal capabilities not reflected in the description.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # Remove launchd plist if [ -f "$LAUNCH_AGENTS/$PLIST_NAME" ]; then rm "$LAUNCH_AGENTS/$PLIST_NAME" echo "✅ Removed launchd plist" fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs use of shell commands (
bash,curl,launchctl,openclaw message send) but does not declare an explicit tool scope or allowed-tools policy. That creates an authorization gap where a reviewer or runtime may underestimate the skill's ability to execute local commands, modify services, and interact with system components.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The auto-execute feature introduces autonomous decision-making into a security control plane: firewall approval. In this context, reducing interruptions is outweighed by the risk of automatically authorizing malicious or suspicious connections.
- Content
md 5. Provides 4 action buttons: Always Allow, Allow Once, Always Block, Block Once 6. Executes the action on LuLu when user taps a button ## Auto-Execute Mode (Optional) For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: 1. Automatically execute the Allow action
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill offers AI-driven auto-execution of firewall Allow actions, including the option to create permanent allow rules, without prominently emphasizing the security consequences of trusting model confidence for network authorization. A mistaken classification could silently permit unwanted outbound connections and weaken the host firewall's protective role.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
The text indicates automatic execution of Allow actions when the AI judges a connection as normal, which delegates a sensitive trust decision to a probabilistic model. This is dangerous because a false positive can directly reduce firewall protection and permit untrusted traffic.
- Content
md ## Auto-Execute Mode (Optional) For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: 1. Automatically execute the Allow action 2. Still send a Telegram notification explaining what was auto-allowed
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
This instance explicitly describes the system automatically executing an Allow firewall action based on AI confidence. Autonomous security decisions over network access can produce unsafe authorizations without human verification, especially when model judgments are fallible or inputs are ambiguous.
- Content
md ## Auto-Execute Mode (Optional) For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: 1. Automatically execute the Allow action 2. Still send a Telegram notification explaining what was auto-allowed **To enable:**
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
To enable:
bash # Create config.json in install directory cat > ~/.openclaw/lulu-monitor/config.json << 'EOF' { "telegramId": "YOUR_TELEGRAM_ID",
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The configuration example actively instructs users to enable
autoExecute, making autonomous firewall decisions easy to turn on without sufficient risk framing. Configuration-driven enablement of automatic allow behavior increases the likelihood of unsafe deployment.- Content
md cat > ~/.openclaw/lulu-monitor/config.json << 'EOF' { "telegramId": "YOUR_TELEGRAM_ID", "autoExecute": true, "autoExecuteAction": "allow-once" } EOF
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The
autoExecuteActionsetting allows automatic enforcement actions, potentially including persistent allow rules. Exposing this as a simple config option lowers the barrier to automating a high-impact security decision with insufficient safeguards.- Content
{ "telegramId": "YOUR_TELEGRAM_ID", "autoExecute": true, "autoExecuteAction": "allow-once" } EOF
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
Documenting
autoExecuteas a normal option normalizes autonomous firewall authorization in a user-facing setup path. Even with a default of false, the feature increases risk because it can be enabled casually and may be misunderstood as reliably safe.- Content
text **Options:** - `autoExecute`: `false` (default) - all alerts require manual button press - `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule) ## Installation
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
Allowing
autoExecuteActionto be set toallowenables creation of permanent firewall allow rules through autonomous decision-making. Persistent automatic approvals are especially dangerous because a single misclassification can create long-lived exposure beyond the current process lifetime.- Content
md **Options:** - `autoExecute`: `false` (default) - all alerts require manual button press - `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule) ## Installation
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
- Content
md **Options:** - `autoExecute`: `false` (default) - all alerts require manual button press - `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule) ## Installation
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Verify
bash curl http://127.0.0.1:4441/statusShould return
{"running":true,...}
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md echo "" echo "🔄 Restarting service..." launchctl unload "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist" 2>/dev/null || true launchctl load "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist" echo "✅ Service restarted" else echo ""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "" echo "🔄 Restarting service..." launchctl unload "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist" 2>/dev/null || true launchctl load "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist" echo "✅ Service restarted" else echo ""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script clones code from a remote GitHub repository and runs npm install --production, which executes remote package lifecycle scripts and installs unpinned dependencies. This is dangerous because it performs network retrieval and code execution without an explicit warning, integrity verification, or version pinning, increasing supply-chain risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer creates a LaunchAgent plist and immediately loads it with launchctl, establishing a persistent user-level background service. While persistence is expected for a monitoring tool, the script does not present a clear consent prompt or explicit warning that it will install an auto-starting agent, which reduces user awareness of a lasting system change.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
This line marks the beginning of LaunchAgent setup, which is a persistence mechanism on macOS. In the context of an installer, persistence may be legitimate, but it still represents an auto-start capability that should be disclosed because it causes code to run beyond the initial install session.
- Content
sh echo "📝 Setting up launchd service..." mkdir -p "$LAUNCH_AGENTS" # Create launchd plist cat > "$LAUNCH_AGENTS/$PLIST_NAME" << EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The script writes a plist into ~/Library/LaunchAgents, creating a persistent execution mechanism for the current user. Even for legitimate software, silently establishing persistence can be abused if the repository or dependencies are compromised, because the payload will continue running automatically.
- Content
sh mkdir -p "$LAUNCH_AGENTS" # Create launchd plist cat > "$LAUNCH_AGENTS/$PLIST_NAME" << EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
This line unloads and then prepares to reload the LaunchAgent, directly managing persistence for the service. In context, this is expected installer behavior, but it is still security-relevant because it modifies auto-start behavior and can keep compromised code resident across sessions.
- Content
sh echo "" echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" # Verify service is running
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
launchctl load activates the newly created LaunchAgent, causing the monitor to run automatically now and on future logins. The skill context makes this somewhat less suspicious because a monitoring companion reasonably needs a background process, but it remains dangerous if combined with unverified remote code retrieval and dependency execution.
- Content
sh echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" # Verify service is running sleep 2
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
launchctl load activates the newly created LaunchAgent, causing the monitor to run automatically now and on future logins. The skill context makes this somewhat less suspicious because a monitoring companion reasonably needs a background process, but it remains dangerous if combined with unverified remote code retrieval and dependency execution.
- Content
sh echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" # Verify service is running sleep 2
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md set -e INSTALL_DIR="$HOME/.openclaw/lulu-monitor" PLIST_NAME="com.openclaw.lulu-monitor.plist" LAUNCH_AGENTS="$HOME/Library/LaunchAgents" echo "🗑️ Uninstalling LuLu Monitor..."
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md set -e INSTALL_DIR="$HOME/.openclaw/lulu-monitor" PLIST_NAME="com.openclaw.lulu-monitor.plist" LAUNCH_AGENTS="$HOME/Library/LaunchAgents" echo "🗑️ Uninstalling LuLu Monitor..."
Static analysis
No suspicious patterns detected.