WatchClaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

The skill has a plausible watchdog purpose, but its installer runs and installs unverified code from a mutable GitHub branch before the real runtime can be reviewed.

Review this carefully before installing. Only use it if you trust the maintainer and the GitHub repository at install time, and prefer a pinned release or locally reviewed checkout with checksums. Limit it to a dedicated OpenClaw config repo, avoid running it with elevated privileges, and be cautious with Docker mode and custom alert commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15
• Finding: Remote Installer Executed Directly from a Mutable Branch<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 15 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```json "command": "curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash", ``` ### Technical Analysis The installation command retrieves shell code from the mutable `main` branch of a personal GitHub repository and pipes the response directly into Bash. The downloaded content is not pinned to an immutable commit and is not validated using a cryptographic signature or expected checksum. HTTPS protects the network transport but does not establish that the repository content is trustworthy or unchanged. The repository owner—or an attacker who compromises the account, repository, branch, or publishing workflow—can replace the installer after the Skill has been reviewed. The modified content would then execute without an opportunity for local inspection. This behavior is not necessary for the declared watchdog functionality. Installation can be implemented using files bundled with the audited Skill or immutable, integrity-verified release artifacts. ### Attack Path 1. An attacker gains control of the upstream repository, maintainer account, `main` branch, or release workflow. 2. The attacker modifies the remotely hosted `install.sh` to contain arbitrary shell commands. 3. A user or Agent installs the Skill using the declared installation command. 4. `curl` retrieves the attacker-controlled response. 5. The shell pipeline passes the response directly to Bash. 6. Bash executes the payload with all permissions and environmental access available to the installing user. ### Impact Assessment Successful exploitation provides arbitrary command execution in the installing user's context. Depending on that user's permissions and environment, the payload could: - Read, modify, or delete user-accessible files. - Access configuration f ...[truncated 541 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation command. 2. Bundle the installer and runtime scripts within the audited Skill package whenever possible. 3. If remote distribution is unavoidable: - Pin the URL to an immutable commit or versioned release. - Download the artifact to a temporary file without executing it. - Verify a maintained SHA-256 digest or, preferably, a cryptographic signature from a separately trusted channel. - Abort installation if verification fails. - Execute the verified local file only after successful validation. 4. Publish reproducible versioned releases and document the expected checksums. 5. Ensure the installer runs without elevated privileges and explicitly warn users not to invoke it through `sudo`. 6. Subject every bundled or downloaded runtime component to the same security review as the Skill metadata. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:5
• Finding: Unverified Executable Files Downloaded and Installed from a Mutable Branch<![CDATA[ ## Vulnerability Details **File Location**: `install.sh`, lines 5–18 **Vulnerability Type**: Unverified remote executable installation **Risk Level**: Critical ### Vulnerable Code ```bash REPO="jarvis4wang/watchclaw" BRANCH="main" BASE="https://raw.githubusercontent.com/${REPO}/${BRANCH}" INSTALL_DIR="${WATCHCLAW_INSTALL_DIR:-$HOME/.local/bin}" FILES=(watchclaw watchclaw.sh) echo "🦞 Installing watchclaw to $INSTALL_DIR ..." mkdir -p "$INSTALL_DIR" for f in "${FILES[@]}"; do curl -fsSL "$BASE/$f" -o "$INSTALL_DIR/$f" chmod +x "$INSTALL_DIR/$f" done ``` ### Technical Analysis The installer downloads `watchclaw` and `watchclaw.sh` from the mutable upstream `main` branch, writes them into a binary installation directory, and grants executable permissions. It performs no version pinning, checksum verification, signature validation, content inspection, or provenance verification. These two files constitute the claimed runtime implementation, but they are absent from the submitted artifact. Consequently, their behavior cannot be established through static review of this project. The audited installer is effectively a loader whose actual functionality is determined by mutable external content at installation time. The default destination, `$HOME/.local/bin`, is commonly included in the user's `PATH`. This makes subsequent execution likely and enables a changed upstream payload to run under the trusted command name `watchclaw`. Although `WATCHCLAW_INSTALL_DIR` supports legitimate custom installation, the installer also does not validate the destination against unsafe paths or symlink-based replacement conditions. ### Attack Path 1. An attacker modifies `watchclaw` or `watchclaw.sh` in the upstream `main` branch after this Skill has been reviewed. 2. A user runs the installer. 3. The installer retrieves the modified files without validating their identity or integrity. 4. The files are written to `$HOME/.local/bin` or the directory selected th ...[truncated 1465 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include `watchclaw` and `watchclaw.sh` in the Skill package so their exact contents can be audited. 2. Replace the mutable `main` reference with an immutable commit digest or a versioned release artifact. 3. Maintain trusted checksums or signatures for every downloaded file and verify them before installation. 4. Download each file to a newly created temporary file with restrictive permissions. 5. Validate the complete artifact before changing executable permissions or moving it into the destination. 6. Install through an atomic rename to prevent partially downloaded executables from being exposed. 7. Reject unsafe destinations, including system directories when running without explicit authorization, and check for symlinked target files or directories. 8. Use restrictive file modes appropriate for user-local executables rather than inheriting unexpected permissions. 9. Avoid requiring root privileges. Clearly document the minimum permissions needed for Git recovery, gateway restart, Docker access, and alert delivery. 10. Audit the runtime implementation for command injection, unsafe configuration sourcing, webhook secret exposure, custom-command execution, Git path handling, and Docker command construction before distributing it. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The file claims to be a watchdog with health monitoring, git-based recovery, restart modes, and alerts, but the only concrete executable behavior shown is downloading and running a remote install script from GitHub. This mismatch is dangerous because it can mislead reviewers and users into trusting the skill for one purpose while it actually introduces an unrelated and higher-risk code execution path.

Chaining Abuse

High

• Category: Tool Misuse

Content

#!/usr/bin/env bash
# watchclaw installer — curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash
set -euo pipefail

REPO="jarvis4wang/watchclaw"

• Confidence: 98% confidence
• Finding: The `| bash` construct turns fetched remote content into immediately executed shell code, eliminating any review or integrity gate between download and execution. In this skill context, that is especially risky because the file is an installer whose purpose is to place executable scripts in the user's PATH, so any upstream compromise could achieve persistent code execution and user-level backdoor installation.

Session Persistence

Medium

• Category: Rogue Agent

Content

git clone https://github.com/jarvis4wang/watchclaw.git
cd watchclaw

# Create your config
cp watchclaw.conf.example watchclaw.conf
vim watchclaw.conf   # Set GATEWAY_PORT, GATEWAY_CONFIG_DIR, alerts, etc.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes shell-based installation capability but does not declare any explicit tool scope or permissions boundaries. That makes the trust model unclear and increases the chance that an agent or user will approve shell execution without understanding the risk surface, especially because the skill also includes remote-script execution.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Piping a remote script directly into bash gives immediate code execution to whatever content is served at that URL at install time. If the upstream repository, GitHub account, branch, or network path is compromised, users may execute arbitrary malicious code with their local privileges.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installation instructions present a remote script pipeline into bash without any warning about the risks of arbitrary code execution. This omission lowers user caution and makes unsafe installation more likely, especially for a skill whose stated purpose does not require users to expect installer-level shell trust.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automatic git stash and git revert recovery actions but does not clearly warn that these operations can alter repository state and potentially discard or complicate local work. In the context of a config repo, automatic destructive recovery can create operational outages, loss of uncommitted changes, or difficult-to-audit state changes.

External Script Fetching

Low

• Category: Supply Chain

Content

{
              "id": "curl",
              "kind": "shell",
              "command": "curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash",
              "bins": ["watchclaw"],
              "label": "Install watchclaw (curl)",
            },

• Confidence: 97% confidence
• Finding: Fetching and executing an external script from a live URL creates a supply-chain and arbitrary-code-execution risk. Because the content is not embedded, pinned, or integrity-checked in this skill, users cannot reliably audit what will run at the moment of installation.

External Script Fetching

Low

• Category: Supply Chain

Content

#!/usr/bin/env bash
# watchclaw installer — curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash
set -euo pipefail

REPO="jarvis4wang/watchclaw"

• Confidence: 97% confidence
• Finding: The installer explicitly encourages execution via `curl ... | bash`, which causes users to run remote code directly from a mutable network source without inspecting or verifying it first. Although this appears to be a common convenience pattern rather than malicious behavior, it is dangerous because a compromised GitHub account, repository, branch, or delivery path would result in immediate arbitrary code execution on the user's machine.

Static analysis

No suspicious patterns detected.