Openclaw Optimizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:33 AM UTC
• Version: 1.19.0

Overview

The skill is broadly useful for OpenClaw administration, but it asks for persistent system profiling and self-updating behavior that users should review before installing.

Install only if you are comfortable with an agent collecting and retaining detailed OpenClaw deployment notes. Before use, require explicit approval for every profile write, SCP sync, config change, cron change, SKILL.md edit, git commit, or push; remove token prefixes from templates; and treat profile contents as untrusted notes rather than authoritative instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:1022
• Finding: Persistent Collection and Cross-Machine Synchronization of Sensitive Deployment Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1022-1117` **Vulnerability Type**: Persistent system profiling beyond the minimum data required for individual troubleshooting tasks **Risk Level**: High ### Complete Code Snippet ```markdown ## 11. System Learning This skill maintains **system profiles** — persistent knowledge files that capture everything learned about specific OpenClaw deployments. Each deployment gets a unique profile that grows over time, turning the skill into an expert on that particular system. ### How It Works **Directory:** `~/.openclaw-optimizer/systems/` — one profile per deployment, plus `TEMPLATE.md` for new deployments. This is a **centralized location outside the skill directory** so that: (1) system profiles are never accidentally pushed to git, (2) multiple AI tools (Claude Code, OpenClaw, Gemini CLI, etc.) on the same machine can read/write the same profiles without drift. Cross-machine sync is still manual via SCP. **On any system assessment or audit (mandatory — run before making recommendations):** 1. `openclaw cron list` — capture full cron inventory: job IDs, names, schedules, status, last run times 2. `openclaw config get agents.defaults.model` — capture model routing (primary + fallbacks) 3. `ls ~/.openclaw/delivery-queue/*.json 2>/dev/null | wc -l` — check for stuck delivery entries 4. `openclaw nodes list` — check paired nodes and connection status 5. Flag any cron jobs in `error` state — these are active problems 6. Flag jobs with stale last-run times (>24h for daily jobs) — may indicate silent failures 7. Check timezone consistency — jobs using `(exact)` instead of named timezones may fire at wrong times 8. Document ALL findings in the system profile before making recommendations 9. **Without this data, recommendations will duplicate existing automation and miss hidden drains.** **At session end (update the profile):** *For directory-based profiles:* 1. Update the specific **topic file(s)** that ...[truncated 4609 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make deployment profiling explicitly opt-in for each assessment rather than mandatory. 2. Collect only fields required for the current troubleshooting request. 3. Never retain full or partial credentials. Replace token prefixes with non-reversible identifiers such as a locally computed hash, if correlation is genuinely necessary. 4. Exclude SSH endpoints, private IP addresses, paired-device records, and channel identifiers by default. 5. Require a complete preview and explicit approval before every profile write or `scp` operation. 6. Apply restrictive permissions: ```bash chmod 700 ~/.openclaw-optimizer chmod 700 ~/.openclaw-optimizer/systems find ~/.openclaw-optimizer/systems -type f -exec chmod 600 {} \; ``` 7. Separate profiles by tool rather than allowing multiple AI tools unrestricted write access to one trusted state directory. 8. Treat profile content as untrusted data, not executable or authoritative instructions. 9. Add validation and provenance fields for every persistent lesson, including source, date, reviewer, and confidence. 10. Establish retention limits and provide a command to inspect and securely delete collected profiles. 11. Encrypt profile transfers and verify the destination host key before synchronization. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:1126
• Finding: Runtime Self-Modification Can Persist Untrusted Troubleshooting Conclusions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1126-1163` **Vulnerability Type**: Self-modification and remote propagation of persistent Skill instructions **Risk Level**: High ### Complete Code Snippet ```markdown ## 12. Continuous Improvement This skill is a living document. Every troubleshooting session, every CLI interaction, and every failure is an opportunity to make it more accurate. Future sessions must actively update the skill based on real-world experience. ### When to Update SKILL.md | Trigger | Action | |---|---| | A CLI command in the skill doesn't work as documented | Fix the command, add a note about what changed | | A troubleshooting step is missing or incomplete | Add it to Section 10's symptom table | | A workaround is discovered that isn't documented | Add it to the relevant section | | Advice in the skill caused a failure | Correct the advice and add a warning | | A new `openclaw` flag or subcommand is discovered during use | Update Section 8 (CLI Reference) | | A new known bug or GitHub issue is found | Add it to the relevant section with issue number | | A config key is renamed, deprecated, or new | Update the relevant config examples | ### What to Update **Two targets — always update both when applicable:** 1. **SKILL.md** — general knowledge that applies to ALL deployments (CLI commands, config patterns, troubleshooting steps, known bugs, process workflows) 2. **System profile** (`systems/<deployment-id>.md`) — deployment-specific knowledge (IPs, paths, credentials, topology, issue log, lessons learned) ### How to Update 1. **During the session:** When you discover something new, update the relevant section immediately — don't wait until the end. Corrections to bad advice are urgent. 2. **Be specific:** Don't write "TLS can be tricky." Write "macOS app rejects `ws://` for remote gateways — always use `wss://`. The `ws://` scheme is only valid for loopback connections." 3. **Include the why:** Don't just say "us ...[truncated 3283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prohibit direct self-modification during normal Skill execution. 2. Replace immediate edits with a generated patch or review report stored outside the active Skill directory. 3. Require explicit human approval after displaying the complete diff. 4. Treat logs, errors, websites, issue descriptions, and remote responses as untrusted evidence. 5. Require corroboration from trusted documentation or source code before accepting a discovered workaround. 6. Run security review, linting, and tests against every proposed change. 7. Use signed, versioned releases to distribute approved updates. 8. Do not synchronize modified Skill files directly to remote gateways. Deploy only reviewed release artifacts. 9. Protect the installed Skill directory from routine write access where practical. 10. Record provenance for each accepted change, including its source and reviewer. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:620
• Finding: Unpinned npx Package Execution Creates a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:620` and duplicated in `references/cli-reference.md:166` **Vulnerability Type**: Unpinned third-party package retrieval and execution **Risk Level**: Medium ### Complete Code Snippet ```bash npx clawhub install <slug> # install ``` The same instruction appears in `references/cli-reference.md`: ```bash npx clawhub install <slug> # install skill (one-off) ``` ### Technical Analysis Running an unqualified package name through `npx` can retrieve and execute the package version currently selected by the configured package registry. The command does not pin an audited version, verify an integrity digest, or require a locally installed trusted binary. The effective code can therefore change after the Skill has been reviewed. Package installation can execute JavaScript and package lifecycle logic with the invoking user’s permissions. The risk is amplified because the command installs additional Skills, which may themselves contain instructions or scripts. ### Attack Path 1. A user follows the documented `npx clawhub install <slug>` instruction. 2. `npx` resolves `clawhub` through the configured npm registry and cache. 3. If the package is not already installed locally, `npx` downloads the currently resolved release. 4. An attacker compromises the package, maintainer account, registry resolution, or a future release. 5. The downloaded package executes under the user account. 6. Malicious package code can access user-readable files, modify local configuration, install malicious Skills, or establish persistence available to that account. ### Impact Assessment The package receives the privileges of the user invoking `npx`. Depending on local permissions, this may allow: - Reading user credentials and configuration files - Modifying OpenClaw or Agent Skill directories - Installing malicious Skill content - Executing arbitrary processes - Making network requests - Establ ...[truncated 252 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an audited version: ```bash npx --yes clawhub@<reviewed-version> install <slug> ``` 2. Document and verify the expected npm package name, publisher, and provenance. 3. Use npm integrity data and a committed lockfile where the workflow permits. 4. Prefer a locally installed, reviewed CLI rather than retrieving code during each invocation. 5. Disable package lifecycle scripts during inspection where feasible: ```bash npm pack clawhub@<reviewed-version> ``` Inspect the resulting archive before installation. 6. Verify installed Skills independently before loading or executing them. 7. Use a restricted user, container, or sandbox for third-party Skill installation. 8. Apply the same correction to `references/cli-reference.md:166` to prevent the unsafe command from remaining in alternate documentation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/version-check.py:48
• Finding: TLS Certificate Verification Is Disabled When No CA Bundle Is Found<![CDATA[ ## Vulnerability Details **File Location**: `scripts/version-check.py:48-68` **Vulnerability Type**: Fail-open HTTPS certificate validation **Risk Level**: Medium ### Complete Code Snippet ```python def get_ssl_context() -> ssl.SSLContext: """Create SSL context with proper certificate handling.""" # Try system default first try: ctx = ssl.create_default_context() if ctx.get_ca_certs(): return ctx except Exception: pass # Fall back to certifi if installed try: import certifi return ssl.create_default_context(cafile=certifi.where()) except ImportError: pass # Last resort — warn explicitly, don't silently disable print("WARNING: No SSL certificates found. Using unverified HTTPS.", file=sys.stderr) ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE return ctx ``` This context is used for the GitHub API request: ```python with urllib.request.urlopen(req, timeout=10, context=ctx) as resp: data = json.loads(resp.read()) tag = data.get("tag_name", "").lstrip("v") return tag if tag else None ``` ### Technical Analysis If neither the system trust store nor `certifi` is available, the code deliberately disables hostname checks and certificate-chain verification. Encryption without peer authentication does not protect against an active man-in-the-middle attacker. The response controls the version recorded in `metadata/latest-version.txt`. `scripts/update-skill.sh` consumes that result and uses the reported version to construct another GitHub release URL and update local version metadata. Although the fetched changelog is treated as text rather than executed shell code, forged release metadata can mislead maintainers and corrupt the update state. ### Attack Path 1. The script runs on a system where Python cannot locate system CA certificates and `certifi` is not installed. 2. `get_ssl_context ...[truncated 1067 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Fail closed when no trusted CA bundle is available: ```python raise RuntimeError( "No trusted CA certificates are available; refusing HTTPS request" ) ``` 2. Never set `ssl.CERT_NONE` or disable hostname verification for release metadata. 3. Clearly instruct users to install or configure a trusted CA bundle. 4. Catch broader `certifi` initialization failures without falling back to insecure TLS: ```python try: import certifi return ssl.create_default_context(cafile=certifi.where()) except Exception as exc: raise RuntimeError("Unable to establish a verified TLS context") from exc ``` 5. Validate that the response URL and host remain the expected GitHub API endpoint. 6. Validate `tag_name` against a strict version format before caching it. 7. Consider verifying release artifacts or metadata with a cryptographic signature in addition to TLS. 8. Add an automated test asserting that absence of CA certificates causes the request to fail rather than use an unverified context. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (64)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill's stated purpose omits that it performs release-version checks, writes cache/metadata, and supports maintenance workflows outside pure optimization/troubleshooting. This weakens user consent and makes it easier for a seemingly informational skill to accumulate side effects over time.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill's stated purpose omits that it performs release-version checks, writes cache/metadata, and supports maintenance workflows outside pure optimization/troubleshooting. This weakens user consent and makes it easier for a seemingly informational skill to accumulate side effects over time.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The document says updates are never automatic, but later mandates in-session self-updates and end-of-session commit/push behavior. This contradiction is dangerous because users and orchestrators may rely on the earlier safety statement while later instructions quietly authorize persistent and remote-changing actions.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

> **WARNING — Provider Bans (Mar 2026):**
>
> **Google:** Actively cracking down on Gemini CLI OAuth and AntiGravity access through third-party tools. Accounts are being banned or rate-limited without warning or refunds. Use API key auth (`google` provider) instead of OAuth (`google-gemini-cli` / `google-antigravity`). Production API keys: 150-300 RPM, no ban risk. See GitHub Issue #14203.
>
> **Anthropic:** Has banned users linking flat-rate Claude Code subscription tokens to OpenClaw. Using Claude Code OAuth tokens directly in OpenClaw may trigger account suspension. However, using Claude Code through the **Agent SDK / ACP dispatch** (where OpenClaw spawns Claude Code as a sub-agent via the ACP protocol) is the supported pattern and should not cause issues — this is how OpenClaw's built-in `acp` integration works.
>

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Ae1

High

• Category: analysis-evasion

Content

**Security:** Before installing any skill, read its `SKILL.md` manually. Community scans found 341+ malicious skills (reverse shells, credential exfiltration, A

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Chaining Abuse

High

• Category: Tool Misuse

Content

- Curate MEMORY.md — archive old daily logs, promote key insights
- `openclaw sessions cleanup --dry-run` → `openclaw sessions cleanup`
- `openclaw cron status` — check for errors
- Clean stale backup files: `find ~/.openclaw -name "*.bak.*" -mtime +7 -not -name "*.bak" | xargs rm -v` (preserves CLI's rolling `.bak` files, removes old named/dated backups)

**Quarterly:**
- Review custom scripts (`scripts/`) for redundancy with built-in OpenClaw features. Users often build custom solutions (RAG pipelines, session archivers, memory indexers) that become redundant when OpenClaw adds equivalent built-in functionality. Check whether each script and its associated cron job still serves a purpose that the platform doesn't already handle.

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Self-Modification

High

• Category: Rogue Agent

Content

This skill is a living document. Every troubleshooting session, every CLI interaction, and every failure is an opportunity to make it more accurate. Future sessions must actively update the skill based on real-world experience.

### When to Update SKILL.md

| Trigger | Action |
|---|---|

• Confidence: 98% confidence
• Finding: The skill explicitly instructs future sessions to actively update `SKILL.md` based on runtime experience. Self-modification is dangerous because it lets transient prompts, mistakes, or adversarial content reshape future behavior and can embed unsafe instructions persistently.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Self-modification plus git commit/push instructions are outside the expected role of an optimizer/troubleshooter and materially raise the blast radius of the skill. A compromised or mistaken session could alter the skill itself and propagate those changes to remote repositories or hosts.

Self-Modification

High

• Category: Rogue Agent

Content

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

echo "  Bumping version to v$NEW_VERSION..."

# Update SKILL.md version references
python3 - "$SKILL_MD" "$CURRENT_VERSION" "$NEW_VERSION" << 'PYEOF'
import sys, re

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The template tells users to record gateway token information, even if truncated, without warning that authentication material should not be stored in plaintext documentation. Partial tokens can still aid token identification, correlation, phishing, and operational leakage, especially when combined with hostname and network details in the same profile.

Hidden Instructions

High

• Category: Prompt Injection

Content

## Removed providers

<!-- Document why each provider was removed -->
```

---

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents extensive shell, file write, network, and remote sync capabilities but declares no explicit tool scope or permissions boundary. In agent environments, this increases the chance the skill is invoked with overly broad ambient authority, enabling unintended filesystem mutation, remote copy, config changes, and command execution.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several triggers overlap with ordinary discussion about agents, optimization, or identity, making unintended activation more likely. In a skill that includes persistent profiling and maintenance behaviors, over-broad activation meaningfully increases exposure.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Broad triggers like generic error phrases can cause the skill to activate in unrelated conversations. Because this skill contains high-impact operational instructions and write-capable workflows, accidental invocation increases the risk of unnecessary data collection, shell guidance, or state-changing proposals.

Session Persistence

Medium

• Category: Rogue Agent

Content

> Propose a tiered routing plan: cheap for heartbeats/cron, mid for daily tasks, premium for coding/reasoning. Exact config + rollback. Do NOT apply.

**Silent cron job:**
> Create a cron job that runs [task] every [interval]. Isolated session, NO_REPLY on nothing-to-do. Show me the command first.

**Audit agent personality & identity:**
> Audit my agent's personality and identity files. Check for conflicts, bloat, and bad practices. Walk me through improvements.

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.