Subagent Watchdog

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:17 AM UTC
• Version: 0.1.0

Overview

This skill is a small, disclosed watchdog script for subagent completion markers, with a limited input-validation issue users should be aware of.

Install only if you want a local watchdog for subagent runs. Use simple trusted labels, avoid path separators or '..' in labels, and set WATCHDOG_CHAT_ID only if you intentionally want failure alerts sent through OpenClaw messaging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: watch.sh:8

Finding

Path Traversal in Completion Marker Label

Content

View full analysis

Vulnerability Details

File Location: watch.sh, lines 8-9 and 26-31
Vulnerability Type: Path traversal caused by insufficient input validation
Risk Level: Medium

Vulnerable Code

bash

LABEL="${1:-}"
WAIT_SECONDS="${2:-}"

if [[ -z "$LABEL" ]]; then
  echo "usage: watch.sh <label> [wait_seconds]" >&2
  exit 2
fi

STATE_DIR="${STATE_DIR:-$(pwd)/state}"
MARKER="$STATE_DIR/${LABEL}.done"

mkdir -p "$STATE_DIR"

sleep "$WAIT_SECONDS"

if [[ -f "$MARKER" ]]; then
  exit 0
fi

Technical Analysis

The caller-controlled LABEL value is directly incorporated into MARKER without rejecting path separators or parent-directory components such as ... Shell quoting prevents word splitting and command injection, but it does not prevent filesystem path traversal.

Consequently, a label such as ../../shared/completed produces a marker path equivalent to:

text

<STATE_DIR>/../../shared/completed.done

The [[ -f "$MARKER" ]] test follows normal filesystem path resolution and can therefore inspect a file outside the intended state directory. The script treats any matching regular file as authoritative evidence that the monitored subagent completed, without verifying that the resolved marker remains under STATE_DIR.

Attack Path

1. An attacker or untrusted caller obtains control over the label passed as the first argument to watch.sh.
2. The attacker identifies or creates an accessible regular file outside the watchdog state directory whose name ends in .done.
3. The attacker supplies a traversal label pointing to that file, for example:

   bash

   ./watch.sh "../../shared/completed" 1
   

4. The script constructs $STATE_DIR/../../shared/completed.done.
5. After the wait expires, [[ -f "$MARKER" ]] succeeds if that external file exists.
6. The watchdog exits with status 0, falsely reporting successful completion and suppressi ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

Apply strict validation before using the label in a filesystem path:

bash

if [[ ! "$LABEL" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] ||
   [[ "$LABEL" == "." || "$LABEL" == ".." ]]; then
  echo "invalid label: use only letters, digits, dots, underscores, and hyphens" >&2
  exit 2
fi

In addition:

1. Reject all path separators and parent-directory components rather than attempting to sanitize them.
2. Canonicalize STATE_DIR and verify that the resolved marker's parent directory is exactly the intended state directory.
3. Consider using an encoded or hashed representation of arbitrary labels as marker filenames.
4. Ensure the state directory has restrictive ownership and permissions so untrusted users cannot create forged completion markers.
5. Add tests covering labels containing ../, /, repeated dots, whitespace, and symbolic-link edge cases.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## What it does
- After you spawn a subagent with a **label**, start a watchdog timer.
- The subagent must write a **completion marker** file.
- If the marker is missing when the timer expires, the watchdog alerts (or exits non-zero so the caller can restart).

## Files

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level comments describe a watchdog that waits for a deadline, checks for a completion marker, and emits a message if the marker is missing. The additional capability to invoke an external OpenClaw binary to send a Telegram or other channel message is a separate notification/integration feature that goes beyond the core watchdog behavior described in the script comments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.