Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-aligned but installs a persistent service that rewrites OpenClaw configuration and includes unsafe setup and notification handling that users should review carefully.
Install only if you intentionally want an always-running local guard that can overwrite OpenClaw heartbeat configuration. Prefer safer Ollama installation steps instead of curl piped to sh, review the generated guard files, keep heartbeat-guard.conf.json writable only by your user, and use --uninstall if you no longer want the background service.
SKILL.md:42Unverified Remote Installer Is Piped Directly into a Shell
heartbeat_ollama_guard.py:99Unescaped Notification Data Can Be Interpreted as AppleScript Code
heartbeat_ollama_guard.py:458Setup Installs a Cross-Session Persistent Configuration-Rewriting Service
The documentation instructs users to fetch and execute a remote shell script directly from the internet using curl piped to sh. This is dangerous because any compromise of the remote server, DNS/TLS interception, or malicious upstream change results in immediate arbitrary code execution on the user's machine.
Linux：
curl -fsSL https://ollama.com/install.sh | sh
The '| sh' construct is a classic command-chaining risk because it turns downloaded content into immediate code execution without verification or review. In this skill's context, the danger is amplified because the command is presented as a normal setup step, increasing the chance that users execute it reflexively.
Linux：
curl -fsSL https://ollama.com/install.sh | sh
The generated README instructs users to install software by piping a remote script directly into a shell (curl ... | sh). This bypasses normal verification and makes users vulnerable to supply-chain compromise, MITM in misconfigured environments, or malicious changes on the remote host, especially because the command is presented as a recommended installation step in a trusted setup guide.
p2 = doc.add_paragraph(style="List Bullet")
p2.add_run("Linux：").bold = True
p2.add_run(" curl -fsSL https://ollama.com/install.sh | sh")
doc.add_paragraph()
doc.add_paragraph("第二步：运行安装向导")
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
print(" 请先安装 Ollama：")
print(" macOS: brew install ollama")
print(" 或访问 https://ollama.com 下载")
print(" Linux: curl -fsSL https://ollama.com/install.sh | sh")
print()
print(" 安装完成后，重新运行：")
print(" python3 heartbeat_ollama_guard.py --setup")
The file forces a single language for all user-facing instructions and safety disclosures, which can violate language/locale policy when no opt-in or alternative language is provided. There is no indication that the skill is intended only for a Chinese-speaking or region-specific audience.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 写入 openclaw.json | 仅 `heartbeat.model` + `models.providers.local` 字段 |
| 守卫守护进程 | 纯本地，60s 轮询，**无网络请求** |
| macOS 系统通知 | 仅守卫检测到未授权改动时触发 |
| 不需要 sudo | ✅ |
| 不读取对话内容 | ✅ |
| 不访问外部 API | ✅ |
The skill installs persistent user-level background execution via LaunchAgent/systemd to monitor and overwrite configuration changes every 60 seconds. Persistence is security-relevant because it survives the initial run, continues modifying files without fresh user consent, and can be repurposed or abused if the installed script or config is later tampered with.
| `~/.openclaw/workspace/.lib/heartbeat-guard.py` | 守卫守护进程脚本 |
| `~/.openclaw/workspace/.lib/heartbeat-guard.conf.json` | 守卫授权配置 |
| `~/.openclaw/workspace/.lib/heartbeat-guard.log` | 守卫运行日志 |
| `~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist` | macOS LaunchAgent |
| `~/.config/systemd/user/openclaw-heartbeat-guard.service` | Linux systemd |
| `~/.openclaw/workspace/.lib/.hog_backups/` | openclaw.json 备份 |
This manifest describes broad capabilities such as '一键安装' and automatic configuration/guard behavior, but does not specify explicit invocation conditions, boundaries, or exclusion cases. In a manifest file, this lack of trigger specificity can make it unclear when the skill should be selected versus other system-management skills.
The module docstring explicitly states it generates a Chinese README, and the document content is written in Chinese throughout. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
("~/.openclaw/workspace/.lib/heartbeat-guard.py", "守卫守护进程脚本（由安装向导生成）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.conf.json", "守卫授权配置（含所有受保护实例）"),
("~/.openclaw/workspace/.lib/heartbeat-guard.log", "守卫运行日志"),
("~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist", "macOS LaunchAgent 配置"),
("~/.config/systemd/user/openclaw-heartbeat-guard.service", "Linux systemd 服务"),
("~/.openclaw/workspace/.lib/.hog_backups/", "openclaw.json 自动备份目录"),
]
This Python skill presents its primary docstring, usage guidance, prompts, status messages, and warnings in Chinese, which imposes a specific language on users. The file does not provide any opt-in, alternative locale, or justification that the skill is intended only for a Chinese-speaking or region-specific environment.
The script is explicitly designed to install persistent user-level components via LaunchAgent or systemd user services, causing code to run automatically after setup. Persistence is security-relevant because it creates a long-lived background process that continuously monitors and rewrites configuration, and users may not fully understand that behavior or be able to easily detect tampering if the script or its config is later modified.
GUARD_BACKUP_DIR= LIB_DIR / ".hog_backups"
LAUNCHAGENT_LABEL = "com.openclaw.heartbeat-guard"
LAUNCHAGENT_PLIST = Path.home() / "Library" / "LaunchAgents" / f"{LAUNCHAGENT_LABEL}.plist"
SYSTEMD_SERVICE = Path.home() / ".config" / "systemd" / "user" / "openclaw-heartbeat-guard.service"
OPENCLAW_PROVIDER_KEY = "local"
The script is explicitly designed to install persistent user-level components via LaunchAgent or systemd user services, causing code to run automatically after setup. Persistence is security-relevant because it creates a long-lived background process that continuously monitors and rewrites configuration, and users may not fully understand that behavior or be able to easily detect tampering if the script or its config is later modified.
GUARD_BACKUP_DIR= LIB_DIR / ".hog_backups"
LAUNCHAGENT_LABEL = "com.openclaw.heartbeat-guard"
LAUNCHAGENT_PLIST = Path.home() / "Library" / "LaunchAgents" / f"{LAUNCHAGENT_LABEL}.plist"
SYSTEMD_SERVICE = Path.home() / ".config" / "systemd" / "user" / "openclaw-heartbeat-guard.service"
OPENCLAW_PROVIDER_KEY = "local"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd, **kw) -> subprocess.CompletedProcess:
return subprocess.run(cmd, **kw)
def get_nested(obj: dict, dotted_path: str):
The embedded plist content defines a persistent LaunchAgent that will auto-run the guard on login and keep it alive. Even though this appears intended for a defensive use case, persistence materially increases risk if the deployed script or configuration is replaced or abused, because it ensures recurring execution without further user action.
# ── launchagent / systemd ──────────────────────────────────────────────────────
PLIST_CONTENT = """\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
PLIST_CONTENT = """\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
PLIST_CONTENT = """\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
PLIST_CONTENT = """\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
PLIST_CONTENT = """\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>