LuLu Monitor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:03 AM UTC
• Version: 2.0.0

Overview

This skill is a firewall companion, but installation fetches and persistently runs unaudited remote code with broad local permissions and optional automatic firewall approvals.

Install only if you are comfortable with a persistent macOS LaunchAgent running code pulled from the publisher's GitHub repository at install time. Review or pin the remote repository first, avoid enabling autoExecute or permanent auto-allow rules, and understand that granting Accessibility to Terminal or osascript and enabling sessions_spawn gives this integration broad local control.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:4
• Finding: Mutable Remote Application and Dependencies Are Executed Without Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:4-37` **Vulnerability Type**: Remote payload retrieval and unsafe dependency installation **Risk Level**: High ### Vulnerable Code ```bash REPO_URL="https://github.com/EasonC13-agent/lulu-monitor.git" INSTALL_DIR="$HOME/.openclaw/lulu-monitor" PLIST_NAME="com.openclaw.lulu-monitor.plist" LAUNCH_AGENTS="$HOME/Library/LaunchAgents" echo "🚀 Installing LuLu Monitor..." echo "" # Check prerequisites first SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" if [ -f "$SCRIPT_DIR/check-prerequisites.sh" ]; then bash "$SCRIPT_DIR/check-prerequisites.sh" || { echo "" echo "❌ Prerequisites check failed. Please resolve the issues above." exit 1 } fi echo "" echo "📦 Cloning repository..." if [ -d "$INSTALL_DIR" ]; then echo " Directory exists, pulling latest..." cd "$INSTALL_DIR" git pull origin main else git clone "$REPO_URL" "$INSTALL_DIR" cd "$INSTALL_DIR" fi echo "" echo "📥 Installing dependencies..." npm install --production ``` ### Technical Analysis The reviewed package does not contain the application referenced by the generated service, including `src/index.js`, `package.json`, or a dependency lockfile. Instead, the installer obtains the effective application from the mutable `main` branch of an external GitHub repository. Neither a commit hash nor a cryptographic digest is verified. Consequently, the code executed by two installations can differ even though the reviewed Skill package remains unchanged. A repository compromise, malicious upstream update, account takeover, or force-push can replace the effective payload after review. The subsequent `npm install --production` also permits npm dependency lifecycle scripts to execute during installation. The audited artifact provides no lockfile or dependency metadata with which to verify versions or integrity. The audit therefore cannot establish what packages or lifecycle scripts will ex ...[truncated 1169 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include every locally executed application source file and dependency manifest in the reviewed Skill package. 2. If an external repository is necessary, check out a reviewed immutable commit hash rather than `main`. 3. Verify a cryptographic digest or signed release before executing downloaded content. 4. Commit a dependency lockfile and use `npm ci` instead of unconstrained `npm install`. 5. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. If scripts are required, audit and explicitly allow each one. 6. Perform dependency provenance, vulnerability, and integrity checks before service registration. 7. Abort installation if the checked-out revision or package integrity differs from the reviewed values. ]]>

T06 · System Persistence

Error

• Location: scripts/install.sh:44
• Finding: Downloaded Application Is Registered as an Automatically Restarting LaunchAgent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:44-80` **Vulnerability Type**: Cross-session service persistence **Risk Level**: High ### Vulnerable Code ```bash # Create launchd plist cat > "$LAUNCH_AGENTS/$PLIST_NAME" << EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.openclaw.lulu-monitor</string> <key>ProgramArguments</key> <array> <string>$(which node)</string> <string>$INSTALL_DIR/src/index.js</string> <string>--verbose</string> </array> <key>RunAtLoad</key> <true/> <key>KeepAlive</key> <true/> <key>StandardOutPath</key> <string>$INSTALL_DIR/logs/stdout.log</string> <key>StandardErrorPath</key> <string>$INSTALL_DIR/logs/stderr.log</string> <key>WorkingDirectory</key> <string>$INSTALL_DIR</string> <key>EnvironmentVariables</key> <dict> <key>PATH</key> <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$(dirname $(which node))</string> </dict> </dict> </plist> EOF echo "" echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" ``` ### Technical Analysis The installer writes a LaunchAgent under `~/Library/LaunchAgents`, enables `RunAtLoad`, enables `KeepAlive`, and immediately loads the service. This causes the downloaded Node.js application to start automatically and be restarted when it terminates. Continuous background execution is related to the declared firewall-monitoring functionality, and the behavior is documented in `SKILL.md`. However, it creates cross-session persistence and is not an appropriate minimum-risk default when the service target is fetched from a mutable external source and is absent from the audited package. `KeepAlive` also m ...[truncated 1145 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to a foreground or manually started process. 2. Make LaunchAgent registration a separate, explicit, informed opt-in action. 3. Do not register a service until its complete target code and dependencies have been integrity-verified. 4. Remove `KeepAlive` unless automatic restart is demonstrably required for the declared functionality. 5. Display the exact executable path, source revision, permissions, and persistence behavior before requesting confirmation. 6. Use modern `launchctl bootstrap` and `launchctl bootout` commands with the appropriate GUI user domain. 7. Ensure failed installations roll back the plist, unload the service, and remove partially downloaded files. 8. Provide a noninteractive removal option that reliably disables and deletes all persistent components. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:52
• Finding: Broad Accessibility and Agent-Session Permissions Expand the Persistent Payload's Authority<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-68` and `SKILL.md:144-148` **Vulnerability Type**: Excessive permission exposure and insufficient least-privilege isolation **Risk Level**: Medium ### Vulnerable Instructions ```markdown Required: - **LuLu Firewall**: `brew install --cask lulu` - **Node.js**: `brew install node` - **OpenClaw Gateway**: Running with Telegram channel configured - **Accessibility Permission**: System Settings > Privacy > Accessibility > Enable Terminal/osascript ### Gateway Configuration (Required) The monitor calls `sessions_spawn` via OpenClaw's `/tools/invoke` HTTP API. This tool is blocked by default. Add it to the allowlist in `~/.openclaw/openclaw.json`: ```json5 { "gateway": { "tools": { "allow": ["sessions_spawn"] } } } ``` ``` The troubleshooting section reinforces the broad Accessibility grant: ```markdown ### Accessibility permission issues AppleScript needs permission to control LuLu. Go to: System Settings > Privacy & Security > Accessibility Enable: Terminal, iTerm, or whatever terminal you use ``` ### Technical Analysis The Skill instructs users to grant Accessibility access to a general-purpose terminal or `osascript` environment. Accessibility access is powerful UI-automation authority and is not inherently limited to the LuLu application. Granting it to Terminal can consequently benefit unrelated scripts and commands launched from that terminal. The Skill also asks users to unblock `sessions_spawn`, which is explicitly disabled by default. The permission appears functionally related to AI analysis, but it is broader than a purpose-specific firewall-alert analysis operation. These capabilities are especially significant because the application that uses them is not included in the audited package and is downloaded from a mutable branch. The reviewed files do not prove direct abuse of these permissions, but the design substantially increases the impact of a compromised ef ...[truncated 1064 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a narrowly scoped, signed helper application for LuLu UI automation instead of granting Accessibility permission to a general-purpose terminal. 2. Restrict the helper to the minimum required LuLu process and UI operations. 3. Replace general `sessions_spawn` access with a purpose-specific analysis endpoint that accepts only validated firewall-alert data. 4. Require authentication and authorization for every local API request. 5. Bind local services exclusively to loopback and validate request origin, schema, action, and state. 6. Document the exact authority conferred by each permission and make elevated capabilities optional where possible. 7. Ensure the effective application is bundled, reviewed, pinned, and integrity-verified before requesting these permissions. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/configure.sh:25
• Finding: Telegram Identifier Is Written to JSON Without Validation or Escaping<![CDATA[ ## Vulnerability Details **File Location**: `scripts/configure.sh:25-34` **Vulnerability Type**: Unsafe configuration generation **Risk Level**: Low ### Vulnerable Code ```bash read -p "Enter your Telegram user ID (or press Enter to keep current): " NEW_TG_ID if [ -n "$NEW_TG_ID" ]; then # Update config cat > "$CONFIG_FILE" << EOF { "telegramId": "$NEW_TG_ID" } EOF echo "" echo "✅ Configuration saved!" ``` ### Technical Analysis The script directly interpolates terminal input into a JSON string without validating that the value is a Telegram numeric identifier or escaping JSON metacharacters. Input containing a quote, backslash, or newline can produce malformed JSON. A crafted value may also introduce additional JSON properties if the resulting content is accepted by the downstream parser. The input is not evaluated as a shell command, so the reviewed code does not demonstrate shell-command injection. The principal risks are configuration corruption and unintended manipulation of downstream configuration semantics. The file is also written without explicitly establishing restrictive permissions or using an atomic replacement operation. ### Attack Path 1. A local user or an operator following attacker-supplied instructions enters a crafted Telegram identifier containing JSON syntax. 2. The here-document inserts the value verbatim into `config.json`. 3. The configuration becomes malformed or contains attacker-influenced additional fields. 4. The service restarts and attempts to parse or act on the altered configuration. 5. Depending on the unseen application's parser and accepted properties, the result may range from denial of service to configuration manipulation. ### Impact Assessment The confirmed impact is corruption of `config.json` and potential failure of the monitor to restart correctly. Additional property injection is structurally possible, but its ultimate security impact cannot be established because the applicati ...[truncated 147 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the Telegram identifier against the expected numeric format before writing it: ```bash if [[ ! "$NEW_TG_ID" =~ ^-?[0-9]+$ ]]; then echo "Invalid Telegram ID" >&2 exit 1 fi ``` 2. Generate JSON with a real serializer, such as Node.js, Python, or `jq`, rather than string interpolation. 3. Set `umask 077` before creating configuration files. 4. Write to a temporary file in the same directory, validate the generated JSON, and atomically rename it into place. 5. Preserve existing supported configuration fields instead of replacing the complete file when only `telegramId` changes. 6. Refuse to restart the service unless the resulting configuration passes strict schema validation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents an operational firewall-monitoring and AI/Telegram integration skill, but the provided code does not monitor firewall alerts, analyze connections, send notifications, or handle LuLu callbacks. Instead, it is purely an uninstall utility for removing the LuLu Monitor service and related files. This is a materially different primary purpose and includes filesystem/service-removal capabilities not reflected in the description.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove launchd plist
if [ -f "$LAUNCH_AGENTS/$PLIST_NAME" ]; then
    rm "$LAUNCH_AGENTS/$PLIST_NAME"
    echo "✅ Removed launchd plist"
fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of shell commands (`bash`, `curl`, `launchctl`, `openclaw message send`) but does not declare an explicit tool scope or allowed-tools policy. That creates an authorization gap where a reviewer or runtime may underestimate the skill's ability to execute local commands, modify services, and interact with system components.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

5. Provides 4 action buttons: Always Allow, Allow Once, Always Block, Block Once
6. Executes the action on LuLu when user taps a button

## Auto-Execute Mode (Optional)

For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will:
1. Automatically execute the Allow action

• Confidence: 95% confidence
• Finding: The auto-execute feature introduces autonomous decision-making into a security control plane: firewall approval. In this context, reducing interruptions is outweighed by the risk of automatically authorizing malicious or suspicious connections.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill offers AI-driven auto-execution of firewall Allow actions, including the option to create permanent allow rules, without prominently emphasizing the security consequences of trusting model confidence for network authorization. A mistaken classification could silently permit unwanted outbound connections and weaken the host firewall's protective role.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Auto-Execute Mode (Optional)

For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will:
1. Automatically execute the Allow action
2. Still send a Telegram notification explaining what was auto-allowed

• Confidence: 96% confidence
• Finding: The text indicates automatic execution of Allow actions when the AI judges a connection as normal, which delegates a sensitive trust decision to a probabilistic model. This is dangerous because a false positive can directly reduce firewall protection and permit untrusted traffic.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Auto-Execute Mode (Optional)

For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will:
1. Automatically execute the Allow action
2. Still send a Telegram notification explaining what was auto-allowed

**To enable:**

• Confidence: 96% confidence
• Finding: This instance explicitly describes the system automatically executing an Allow firewall action based on AI confidence. Autonomous security decisions over network access can produce unsafe authorizations without human verification, especially when model judgments are fallible or inputs are ambiguous.

Session Persistence

Medium

• Category: Rogue Agent

Content

**To enable:**
```bash
# Create config.json in install directory
cat > ~/.openclaw/lulu-monitor/config.json << 'EOF'
{
  "telegramId": "YOUR_TELEGRAM_ID",

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

cat > ~/.openclaw/lulu-monitor/config.json << 'EOF'
{
  "telegramId": "YOUR_TELEGRAM_ID",
  "autoExecute": true,
  "autoExecuteAction": "allow-once"
}
EOF

• Confidence: 93% confidence
• Finding: The configuration example actively instructs users to enable `autoExecute`, making autonomous firewall decisions easy to turn on without sufficient risk framing. Configuration-driven enablement of automatic allow behavior increases the likelihood of unsafe deployment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

{
  "telegramId": "YOUR_TELEGRAM_ID",
  "autoExecute": true,
  "autoExecuteAction": "allow-once"
}
EOF
```

• Confidence: 94% confidence
• Finding: The `autoExecuteAction` setting allows automatic enforcement actions, potentially including persistent allow rules. Exposing this as a simple config option lowers the barrier to automating a high-impact security decision with insufficient safeguards.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```

**Options:**
- `autoExecute`: `false` (default) - all alerts require manual button press
- `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule)

## Installation

• Confidence: 94% confidence
• Finding: Documenting `autoExecute` as a normal option normalizes autonomous firewall authorization in a user-facing setup path. Even with a default of false, the feature increases risk because it can be enabled casually and may be misunderstood as reliably safe.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Options:**
- `autoExecute`: `false` (default) - all alerts require manual button press
- `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule)

## Installation

• Confidence: 96% confidence
• Finding: Allowing `autoExecuteAction` to be set to `allow` enables creation of permanent firewall allow rules through autonomous decision-making. Persistent automatic approvals are especially dangerous because a single misclassification can create long-lived exposure beyond the current process lifetime.

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

**Options:**
- `autoExecute`: `false` (default) - all alerts require manual button press
- `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule)

## Installation

• Confidence: 80% confidence
• Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Verify

```bash
curl http://127.0.0.1:4441/status
```

Should return `{"running":true,...}`

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo ""
    echo "🔄 Restarting service..."
    launchctl unload "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist" 2>/dev/null || true
    launchctl load "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist"
    echo "✅ Service restarted"
else
    echo ""

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo ""
    echo "🔄 Restarting service..."
    launchctl unload "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist" 2>/dev/null || true
    launchctl load "$HOME/Library/LaunchAgents/com.openclaw.lulu-monitor.plist"
    echo "✅ Service restarted"
else
    echo ""

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script clones code from a remote GitHub repository and runs npm install --production, which executes remote package lifecycle scripts and installs unpinned dependencies. This is dangerous because it performs network retrieval and code execution without an explicit warning, integrity verification, or version pinning, increasing supply-chain risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer creates a LaunchAgent plist and immediately loads it with launchctl, establishing a persistent user-level background service. While persistence is expected for a monitoring tool, the script does not present a clear consent prompt or explicit warning that it will install an auto-starting agent, which reduces user awareness of a lasting system change.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "📝 Setting up launchd service..."
mkdir -p "$LAUNCH_AGENTS"

# Create launchd plist
cat > "$LAUNCH_AGENTS/$PLIST_NAME" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

• Confidence: 94% confidence
• Finding: This line marks the beginning of LaunchAgent setup, which is a persistence mechanism on macOS. In the context of an installer, persistence may be legitimate, but it still represents an auto-start capability that should be disclosed because it causes code to run beyond the initial install session.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$LAUNCH_AGENTS"

# Create launchd plist
cat > "$LAUNCH_AGENTS/$PLIST_NAME" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 95% confidence
• Finding: The script writes a plist into ~/Library/LaunchAgents, creating a persistent execution mechanism for the current user. Even for legitimate software, silently establishing persistence can be abused if the repository or dependencies are compromised, because the payload will continue running automatically.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo ""
echo "🔄 Starting service..."
mkdir -p "$INSTALL_DIR/logs"
launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true
launchctl load "$LAUNCH_AGENTS/$PLIST_NAME"

# Verify service is running

• Confidence: 96% confidence
• Finding: This line unloads and then prepares to reload the LaunchAgent, directly managing persistence for the service. In context, this is expected installer behavior, but it is still security-relevant because it modifies auto-start behavior and can keep compromised code resident across sessions.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "🔄 Starting service..."
mkdir -p "$INSTALL_DIR/logs"
launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true
launchctl load "$LAUNCH_AGENTS/$PLIST_NAME"

# Verify service is running
sleep 2

• Confidence: 97% confidence
• Finding: launchctl load activates the newly created LaunchAgent, causing the monitor to run automatically now and on future logins. The skill context makes this somewhat less suspicious because a monitoring companion reasonably needs a background process, but it remains dangerous if combined with unverified remote code retrieval and dependency execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "🔄 Starting service..."
mkdir -p "$INSTALL_DIR/logs"
launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true
launchctl load "$LAUNCH_AGENTS/$PLIST_NAME"

# Verify service is running
sleep 2

• Confidence: 97% confidence
• Finding: launchctl load activates the newly created LaunchAgent, causing the monitor to run automatically now and on future logins. The skill context makes this somewhat less suspicious because a monitoring companion reasonably needs a background process, but it remains dangerous if combined with unverified remote code retrieval and dependency execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

set -e

INSTALL_DIR="$HOME/.openclaw/lulu-monitor"
PLIST_NAME="com.openclaw.lulu-monitor.plist"
LAUNCH_AGENTS="$HOME/Library/LaunchAgents"

echo "🗑️  Uninstalling LuLu Monitor..."

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

set -e

INSTALL_DIR="$HOME/.openclaw/lulu-monitor"
PLIST_NAME="com.openclaw.lulu-monitor.plist"
LAUNCH_AGENTS="$HOME/Library/LaunchAgents"

echo "🗑️  Uninstalling LuLu Monitor..."

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.