Community Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

This watchdog is mostly aligned with its stated purpose, but it installs a persistent service that can restart a gateway automatically and can expose operational status data too broadly.

Install only if you intend to run a persistent watchdog on that server. Review or create the missing systemd service file yourself, test in staging first, restrict the nginx endpoints to trusted clients, avoid public wildcard CORS, use tighter file permissions where possible, and document how to disable the service and remove its state files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: references/nginx-snippet.conf:5

Finding

Unauthenticated Exposure of Watchdog Operational Information

Content

View full analysis

Vulnerability Details

File Location: references/nginx-snippet.conf, lines 5-18
Vulnerability Type: Unauthenticated operational information disclosure
Risk Level: Low

Vulnerable Code

nginx

location /watchdog/state.json {
    alias /opt/openclaw-watchdog/watchdog-state.json;
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    add_header Cache-Control "no-cache, no-store";
}

# Watchdog alert — returns JSON only when status is critical; 404 otherwise
# Useful for monitoring: if this endpoint returns data, something is wrong
location /watchdog/alert.json {
    alias /opt/openclaw-watchdog/watchdog-alert.json;
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    add_header Cache-Control "no-cache, no-store";
}

Related file-permission and data-generation behavior appears in scripts/watchdog.py, lines 100-119:

python

alert = {
    "severity": severity,
    "subject": subject,
    "message": message,
    "timestamp": datetime.now(timezone.utc).isoformat(),
    "gateway_url": cfg["HEALTH_URL"],
}
alert_path = Path(cfg["ALERT_FILE"])
alert_path.parent.mkdir(parents=True, exist_ok=True)
with open(str(alert_path), "w") as f:
    json.dump(alert, f, indent=2)
os.chmod(str(alert_path), 0o644)

Technical Analysis

The recommended nginx locations expose the watchdog state and alert files without authentication, client-network restrictions, or authorization checks. They also return Access-Control-Allow-Origin: *, permitting browser applications from any origin to read the responses when the endpoints are network-accessible.

The published data can include gateway health status, consecutive failure and restart counts, timestamps, alert messages, and the configured health endpoint URL. The generated JSON files are also assigned mode 0644, making them readable by every local user. Although remot ...[truncated 1498 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the status endpoints to trusted monitoring systems using nginx allow and deny directives, a private VPN, or firewall rules.
2. Require authentication, mutual TLS, or a reverse-proxy authorization layer when the endpoints must be reachable over a broader network.
3. Remove Access-Control-Allow-Origin * unless cross-origin browser access is explicitly required. If required, allow only specific trusted origins.
4. Publish only the minimum telemetry needed by the monitor. Avoid exposing internal URLs and detailed recovery information where possible.
5. Store the files with mode 0640 and use a dedicated group shared by the watchdog and web server rather than making them world-readable.
6. Ensure parent directories are not unnecessarily accessible to unrelated local users.
7. Serve the endpoints exclusively over HTTPS when they leave the local host or a trusted private network.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/watchdog.py (reported line 175)May include surrounding context.

python

)

    # Set up environment for systemctl --user
    env = os.environ.copy()
    uid = os.getuid()
    env["XDG_RUNTIME_DIR"] = f"/run/user/{uid}"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents shell and environment-dependent operational actions, including service management and deployment steps, but does not declare any tool scope or permissions boundaries. This can cause an agent or user to run impactful commands without clear authorization constraints, increasing the risk of unintended system changes during deployment or troubleshooting.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

5. Enable and start:

bash

sudo systemctl daemon-reload
sudo systemctl enable openclaw-gateway-watchdog
sudo systemctl start openclaw-gateway-watchdog

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

5. Enable and start:

bash

sudo systemctl daemon-reload
sudo systemctl enable openclaw-gateway-watchdog
sudo systemctl start openclaw-gateway-watchdog

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

systemctl enable creates persistent startup behavior, causing the watchdog to run automatically on boot and continue managing a gateway service without further user confirmation. In the context of an agent skill, this is a system-impacting persistent change that can be risky if a user does not fully understand or approve long-term execution.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

sudo systemctl daemon-reload
sudo systemctl enable openclaw-gateway-watchdog
sudo systemctl start openclaw-gateway-watchdog

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Enabling the watchdog service introduces persistence, causing the skill's behavior to survive reboots and continue affecting service state over time. In this context, persistence is more dangerous because the watchdog can repeatedly restart a gateway and expose state files, so a misconfiguration may create long-lived operational or security issues.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

sudo systemctl daemon-reload
sudo systemctl enable openclaw-gateway-watchdog
sudo systemctl start openclaw-gateway-watchdog

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

- **Watchdog not starting**: Check `LOG_FILE` and ensure `STATE_FILE` directory is writable by the service user.
- **Restart failing**: Verify the service user can run `systemctl --user restart GATEWAY_SERVICE`. Check `XDG_RUNTIME_DIR` is set.
- **Permission denied on state file**: Ensure the directory and files are readable by the web server user (e.g. `www-data`) if exposing via nginx.
- **Nginx 403 on status endpoints**: Ensure directory traversal permissions (`chmod 755` on parent directories, `chmod 644` on JSON files).

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

- **Watchdog not starting**: Check `LOG_FILE` and ensure `STATE_FILE` directory is writable by the service user.
- **Restart failing**: Verify the service user can run `systemctl --user restart GATEWAY_SERVICE`. Check `XDG_RUNTIME_DIR` is set.
- **Permission denied on state file**: Ensure the directory and files are readable by the web server user (e.g. `www-data`) if exposing via nginx.
- **Nginx 403 on status endpoints**: Ensure directory traversal permissions (`chmod 755` on parent directories, `chmod 644` on JSON files).

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/watchdog.conf (reported line 20)May include surrounding context.

text

MAX_RESTART_ATTEMPTS = 3

# Path to the persistent state JSON file
# Set permissions readable by your web server (e.g. chmod 644) if exposing via nginx
STATE_FILE = /opt/openclaw-watchdog/watchdog-state.json

# Path to the alert JSON file (only written when status is critical)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/watchdog.py (reported line 100)May include surrounding context.

python

def save_state(state: dict) -> None:
    """Persist state to disk so it survives service restarts."""
    try:
        state_path = Path(cfg["STATE_FILE"])
        state_path.parent.mkdir(parents=True, exist_ok=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/watchdog.py (reported line 149)May include surrounding context.

python

def check_health() -> bool:
    """Return True if the gateway health endpoint responds OK."""
    try:
        result = subprocess.run(
            ["curl", "-sf", "--max-time", "10", cfg["HEALTH_URL"]],
            capture_output=True, text=True, timeout=15,
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/watchdog.py (reported line 181)May include surrounding context.

python

# Try systemctl --user restart
    try:
        result = subprocess.run(
            ["systemctl", "--user", "restart", cfg["GATEWAY_SERVICE"]],
            capture_output=True, text=True, timeout=30, env=env,
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill clearly automates restarts, persistent service installation, and status file exposure, but the quick-start section does not prominently warn that deployment changes system behavior and may affect service availability. Users may apply it without understanding that it can restart production services or expose monitoring data over HTTP.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.