T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:22- Finding
Unpinned Remote Installation Script Is Executed Directly by Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw macOS Always-On
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent always-on OpenClaw purpose, but its privileged installer uses unsafe install patterns and can expose the gateway token to local users.
Install only if you truly need OpenClaw running persistently at the system level. Do not use the one-line curl-to-bash command; download a pinned installer, inspect it, and verify integrity first. On systems where this installer has already been used, treat the gateway token as potentially exposed to local users and rotate it. Prefer a LaunchAgent or a Keychain-backed token design if always-on system service behavior is not required.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
install.sh:35- Finding
Gateway Authentication Token Is Stored in a World-Readable LaunchDaemon Plist
- Content
View full analysis
/dev/null | tr -d '"' || echo "") ``` `install.sh:113-125`: ```xml EnvironmentVariables HOME /Users/$USERNAME PATH /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin OPENCLAW_GATEWAY_PORT 18789 OPENCLAW_GATEWAY_TOKEN $GATEWAY_TOKEN ``` `install.sh:152-157`: ```bash echo -e "${YELLOW}📦 Installing LaunchDaemon (requires sudo)...${NC}" # Install plist sudo cp "$TEMP_PLIST" "$PLIST_PATH" sudo chown root:wheel "$PLIST_PATH" sudo chmod 644 "$PLIST_PATH" ``` ### Technical Analysis The installer retrieves the OpenClaw gateway authentication token and interpolates it directly into the LaunchDaemon plist. It then assigns mode `0644` to that plist. Mode `0644` grants read access to every local user. Root ownership prevents ordinary users from modifying the installed plist, but it does not prevent them from reading the embedded token. The temporary plist containing the same token is also not explicitly restricted or removed. This behavior contradicts the documentation's claim that the plist is readable only by root and the target user. A LaunchDaemon configuration file should not be treated as an appropriate plaintext secret store. ### Attack Path 1. A user installs the LaunchDaemon with a valid gateway token. 2. The installer writes the token into `/Library/LaunchDaemons/ai.openclaw.gateway.plist`. 3. The installer sets the file mode to `0644`. 4. Another local account or a low-privileged process reads the plist. ...[truncated 689 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
install.sh:14- Finding
Predictable Shared Temporary File Enables Privileged LaunchDaemon Configuration Replacement
- Content
View full analysis
"$TEMP_PLIST" << EOF ``` The heredoc continues through line 133 and writes the complete daemon configuration to the fixed path. `install.sh:152-165`: ```bash echo -e "${YELLOW}📦 Installing LaunchDaemon (requires sudo)...${NC}" # Install plist sudo cp "$TEMP_PLIST" "$PLIST_PATH" sudo chown root:wheel "$PLIST_PATH" sudo chmod 644 "$PLIST_PATH" echo -e "${GREEN} ✅ Installed to $PLIST_PATH${NC}" echo "" echo -e "${YELLOW}🚀 Starting service...${NC}" # Start service sudo launchctl bootstrap system "$PLIST_PATH" ``` ### Technical Analysis The installer uses the fixed path `/tmp/ai.openclaw.gateway.plist` in a shared temporary directory. It does not create a private temporary directory, securely create the file, verify file ownership or type, or confirm that the source has not changed before the privileged copy. There is a time-of-check/time-of-use interval between writing the file and executing `sudo cp`. On a multi-user machine, another local user can monitor the predictable pathname and attempt to replace the source after it has been generated but before it is copied into `/Library/LaunchDaemons`. The resulting file is subsequently owned by root and loaded into the system launchd domain. An attacker-controlled replacement could omit the intended `UserName` field or select an attacker-controlled executable. A valid malicious plist could consequently request execution with LaunchDaemon privileges. Exploitabilit ...[truncated 1428 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (178)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The curl-to-bash pipeline is a classic dangerous command chain because it combines network retrieval and immediate shell execution without an opportunity for inspection. In this skill, that chain is particularly risky because the install process is associated with admin-required setup and persistent system service creation, compounding the blast radius of any malicious or tampered content.
- Content
One-line installation:
bash curl -fsSL https://raw.githubusercontent.com/happydog-intj/openclaw-macos-always-on/master/install.sh | bashOr manual installation - see SKILL.md for detailed instructions.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
- Enhanced KeepAlive - Network-aware restart with crash recovery
xml <!-- Key configuration --> <key>ProgramArguments</key> <array> <string>/usr/bin/caffeinate</string>
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping curl output directly into bash creates an unsafe execution chain that eliminates review, integrity validation, and provenance checks before code execution. In a skill that establishes persistence and uses admin-level setup, this sharply increases the chance of full host compromise if the upstream content is altered or intercepted.
- Content
一键安装命令：
bash curl -fsSL https://raw.githubusercontent.com/happydog-intj/openclaw-macos-always-on/master/install.sh | bash或手动安装 - 查看 SKILL.md 获取详细说明。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # 停止并删除 sudo launchctl bootout system/ai.openclaw.gateway sudo rm /Library/LaunchDaemons/ai.openclaw.gateway.plist # 可选：恢复 LaunchAgent mv ~/Library/LaunchAgents/ai.openclaw.gateway.plist.disabled \
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # 停止并删除 sudo launchctl bootout system/ai.openclaw.gateway sudo rm /Library/LaunchDaemons/ai.openclaw.gateway.plist # 可选：恢复 LaunchAgent mv ~/Library/LaunchAgents/ai.openclaw.gateway.plist.disabled \
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill recommends piping a remotely fetched script directly into bash with no integrity verification, pinning, or review step. That creates a direct arbitrary code execution path: if the remote content, repository, branch, or transport trust is compromised, users immediately execute attacker-controlled shell code.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Piping curl output directly into bash chains remote retrieval with immediate shell execution, eliminating any opportunity for review or integrity validation. This is a classic unsafe installation pattern that can deliver arbitrary code if the source is tampered with.
- Content
One-Command Installation
bash curl -fsSL https://raw.githubusercontent.com/YOUR_USERNAME/clawd/master/skills/macos-launchdaemon/install.sh | bashOr manual setup below ⬇️
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <key>RunAtLoad</key> <true/> <!-- Enhanced KeepAlive for network services --> <key>KeepAlive</key> <dict> <key>SuccessfulExit</key>
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The command permanently removes a file in /Library/LaunchDaemons, which is a sensitive system path containing persistence configuration. In a skill context, destructive parameter use is real because it can remove system configuration unexpectedly if copied without understanding.
- Content
md sudo launchctl bootout system/ai.openclaw.gateway # 2. Remove plist sudo rm /Library/LaunchDaemons/ai.openclaw.gateway.plist # 3. Restore LaunchAgent (optional) mv ~/Library/LaunchAgents/ai.openclaw.gateway.plist.disabled ~/Library/LaunchAgents/ai.openclaw.gateway.plist 2>/dev/null
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Check who can read the plist
ls -l /Library/LaunchDaemons/ai.openclaw.gateway.plist
More secure: use macOS Keychain (advanced)
Store token in keychain and retrieve at runtime
text
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The skill's design places the gateway token into LaunchDaemon environment variables stored in a plist, effectively harvesting a credential from configuration and materializing it in a broadly readable file. Because the file is configured 0644, any local user may be able to read the secret and impersonate or interfere with the gateway.
- Content
ls -l /Library/LaunchDaemons/ai.openclaw.gateway.plist
More secure: use macOS Keychain (advanced)
Store token in keychain and retrieve at runtime
text ## Performance Impact
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ls -l /Library/LaunchDaemons/ai.openclaw.gateway.plist
More secure: use macOS Keychain (advanced)
Store token in keychain and retrieve at runtime
text ## Performance Impact
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
This migration/removal step also uses rm against the system LaunchDaemon plist, making destructive modification of persistent system configuration easy to execute. The danger is increased by its placement in a concise migration example.
- Content
bash # Stop daemon sudo launchctl bootout system/ai.openclaw.gateway sudo rm /Library/LaunchDaemons/ai.openclaw.gateway.plist # Restore agent mv ~/Library/LaunchAgents/ai.openclaw.gateway.plist.backup ~/Library/LaunchAgents/ai.openclaw.gateway.plist
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The quick reference exposes a high-risk destructive command against a system persistence file with no surrounding safety context. Users are especially likely to copy-paste quick-reference commands without reading details.
- Content
Uninstall
sudo launchctl bootout system/ai.openclaw.gateway sudo rm /Library/LaunchDaemons/ai.openclaw.gateway.plist
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README explicitly recommends fetching a remote script and piping it directly to a shell, which executes unreviewed code immediately and bypasses normal integrity review. In this skill's context, the script is intended to set up a system-level LaunchDaemon and requires admin privileges, so any compromise of the remote content or repository could lead to privileged persistence or arbitrary code execution.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 📋 Requirements - **macOS 10.15+** (tested on 14.4) - **Admin access** (sudo required for installation) - **OpenClaw already installed** (`npm install -g openclaw`) ## 📖 Documentation
Static analysis
No suspicious patterns detected.