Security audit

Agent Defibrillator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible watchdog, but its installer can fetch changing remote code and install it as a persistent background service.

Review this carefully before installing. Prefer a pinned, reviewed local checkout, remove or disable the install.sh remote download path, and avoid the README curl-to-bash command. Install only if you are comfortable with a user-level background LaunchAgent that can restart OpenClaw, send optional Discord messages through your configured OpenClaw CLI, and terminate matching gateway processes.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:47
Finding: Remote Installer Is Executed Directly from a Mutable Branch
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:49
Finding: Unverified Remote Payload Is Installed as a Persistent Launchd Service
Content: View full analysis
/dev/null; then curl -fsSL "$SCRIPT_URL" -o "$INSTALL_DIR/$SCRIPT_NAME" 2>/dev/null || { # Fallback: copy from local if curl fails (for local installs) if [ -f "$(dirname "$0")/defibrillator.sh" ]; then cp "$(dirname "$0")/defibrillator.sh" "$INSTALL_DIR/$SCRIPT_NAME" else echo "❌ Failed to download script" exit 1 fi } else cp "$(dirname "$0")/defibrillator.sh" "$INSTALL_DIR/$SCRIPT_NAME" fi chmod +x "$INSTALL_DIR/$SCRIPT_NAME" echo "✅ Script installed at $INSTALL_DIR/$SCRIPT_NAME" # Create launchd plist echo "📝 Creating launchd service..." cat > "$PLIST_DIR/$PLIST_NAME" << EOF Label com.openclaw.defibrillator ProgramArguments /bin/bash ${INSTALL_DIR}/${SCRIPT_NAME} EnvironmentVariables DEFIB_GATEWAY_LABEL ${GATEWAY_LABEL} DEFIB_LOG_DIR ${LOG_DIR} StartInterval ${CHECK_INTERVAL} RunAtLoad Nice 10 StandardOutPath ${LOG_DIR}/defibrillator.log StandardErrorPath ${LOG_DIR}/defibrillator.log < ...[truncated 2194 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: defibrillator.sh:11
Finding: Predictable Shared Temporary Files Permit Symlink-Based File Overwrite
Content: View full analysis
/dev/null) if [ -n "$LOCK_PID" ] && kill -0 "$LOCK_PID" 2>/dev/null; then exit 0 # Silent exit, another instance running else rm -f "$LOCKFILE" fi fi echo $$ > "$LOCKFILE" trap 'rm -f "$LOCKFILE"' EXIT ``` ```bash if check_process; then log "RESTART: SUCCESS via kickstart" date +%s > "$COOLDOWN_FILE" return 0 fi ``` ```bash if restart_gateway; then date +%s > "$VERSION_RESTART_FILE" notify "🔄 Gateway watchdog restarted due to version mismatch. Now running **$CLI_VERSION**" log "VERSION: Restart complete, notification sent" fi ``` ### Technical Analysis The watchdog stores lock and cooldown state under fixed, globally predictable names in `/tmp`. It writes to those paths with ordinary shell redirection and does not securely create the files, verify ownership, reject symbolic links, or place them in a user-private directory. A local attacker able to create one of these paths before the watchdog runs can attempt to replace it with a symbolic link. Shell redirection may then follow that link and truncate or overwrite a target file writable by the watchdog user. The same predictable lock file also permits local denial of service. A crafted lock value corresponding to a live PID can cause the watchdog to conclude that another instance is running and exit. ### Attack Path 1. A local attacker predicts one of the fixed `/tmp/openclaw-gateway-*` paths. 2. Before the watchdog runs, the attacker creates a symbolic link from ...[truncated 824 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: defibrillator.sh:151
Finding: Broad Process Matching Can Forcibly Terminate Unrelated Processes
Content: View full analysis
/dev/null sleep 2 fi ``` ### Technical Analysis The fallback restart logic searches the full `ps aux` output for the text `openclaw-gateway` anywhere in a command line. It does not verify that each result belongs to the configured launchd service, corresponds to the expected executable, or is actually orphaned. Every matching PID is passed to `kill -9`. `SIGKILL` cannot be handled by the target process and prevents orderly shutdown and state cleanup. This operation is related to the declared restart function, but the selection scope is broader than necessary. The watchdog should terminate only the process associated with the configured launchd job. ### Attack Path 1. A process owned by the affected user runs with `openclaw-gateway` somewhere in its command line, even though it is unrelated to the monitored service. 2. The watchdog detects a health failure and reaches the bootout/bootstrap fallback. 3. The broad `ps | grep` pipeline includes the unrelated process in `ORPHAN_PIDS`. 4. The watchdog sends `SIGKILL` to every collected PID. 5. The unrelated process terminates immediately without cleanup. An attacker with the ability to influence a user-owned process’s command line could also deliberately create a matching process to induce predictable termination or interfere with restart handling. ### Impact Assessment The watchdog can terminate unrelated processes that the LaunchAgent user has permission to signal. This can cause denial of service, interruption of other user applications, l ...[truncated 238 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Piping the output of curl directly into bash is a classic dangerous command chain because it couples network retrieval with immediate execution, eliminating review and making tampering consequences immediate. In a skill for AI agents, this pattern is especially risky because autonomous tooling may run it verbatim, causing unattended code execution and persistence installation.
Content: Scanner excerpt · README.md (reported line 50)May include surrounding context.
Option 1: One-liner (recommended)

bash
curl -fsSL https://raw.githubusercontent.com/hazy2go/agent-defibrillator/main/install.sh | bash

Option 2: Clone & Install

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description says the skill is a watchdog with optional Discord notifications, but the referenced behavior includes additional undeclared actions: checking a localhost health endpoint, inspecting local session file metadata, and performing version-mismatch restart logic. Hidden or under-disclosed behavior is dangerous because it expands the skill's access to local services and files beyond what a user would reasonably expect, weakening informed consent and review.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 139)May include surrounding context.
bash
launchctl bootout gui/$(id -u)/com.openclaw.defibrillator rm ~/Library/LaunchAgents/com.openclaw.defibrillator.plist rm ~/.openclaw/scripts/defibrillator.sh

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
bash
launchctl bootout gui/$(id -u)/com.openclaw.defibrillator rm ~/Library/LaunchAgents/com.openclaw.defibrillator.plist rm ~/.openclaw/scripts/defibrillator.sh

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 140)May include surrounding context.
bash
launchctl bootout gui/$(id -u)/com.openclaw.defibrillator rm ~/Library/LaunchAgents/com.openclaw.defibrillator.plist rm ~/.openclaw/scripts/defibrillator.sh

Requirements

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
bash
launchctl bootout gui/$(id -u)/com.openclaw.defibrillator rm ~/Library/LaunchAgents/com.openclaw.defibrillator.plist rm ~/.openclaw/scripts/defibrillator.sh

Requirements

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README recommends executing a remotely fetched script directly with curl ... | bash, which removes the user's opportunity to inspect the code and creates a single-step path to arbitrary code execution if the upstream source, network path, or repository is compromised. In an agent-focused skill, this is more dangerous because users may paste it into an autonomous agent that will perform system-level actions without human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The agent-directed prompt tells an AI agent to clone a repository and run install.sh, then verify a launchd service, without warning that this performs persistent system changes and executes untrusted code. Because this skill is specifically designed for agent use, the prompt lowers friction for autonomous execution and increases the chance of unattended installation of persistence-capable code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents shell-based installation, service management, log inspection, and file deletion actions but does not declare any tool scope such as permissions or allowed-tools. This creates an execution-transparency gap: an agent or reviewer cannot easily determine the skill's operational boundaries, increasing the risk of unintended shell execution on the host.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad activators such as 'gateway monitor,' 'auto-restart agent,' and 'keep agent alive,' which can overlap with normal troubleshooting or conversational requests. Ambiguous triggers increase the chance that the skill activates unexpectedly and leads an agent toward executing shell-based installation or persistence-related actions without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 111)May include surrounding context.
md
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 139)May include surrounding context.
md
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 157)May include surrounding context.
md
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 158)May include surrounding context.
md
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · defibrillator.sh (reported line 17)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · defibrillator.sh (reported line 131)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 21)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 70)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 74)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 75)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 102)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 104)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · defibrillator.sh (reported line 17)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · defibrillator.sh (reported line 130)May include surrounding context.
sh
VERSION_RESTART_FILE="/tmp/openclaw-gateway-last-version-restart" # Gateway config GATEWAY_PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" GATEWAY_LABEL="ai.openclaw.gateway" # Notification config

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Chaining Abuse

Option 1: One-liner (recommended)

Option 2: Clone & Install

Tp4

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Requirements

Tool Parameter Abuse

Requirements

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Vague Triggers

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Static analysis