ClawHub
Back to skill

Security audit

WatchClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill has a plausible watchdog purpose, but its installer runs and installs unverified code from a mutable GitHub branch before the real runtime can be reviewed.

Review this carefully before installing. Only use it if you trust the maintainer and the GitHub repository at install time, and prefer a pinned release or locally reviewed checkout with checksums. Limit it to a dedicated OpenClaw config repo, avoid running it with elevated privileges, and be cautious with Docker mode and custom alert commands.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:15
Finding

Remote Installer Executed Directly from a Mutable Branch

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:5
Finding

Unverified Executable Files Downloaded and Installed from a Mutable Branch

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The file claims to be a watchdog with health monitoring, git-based recovery, restart modes, and alerts, but the only concrete executable behavior shown is downloading and running a remote install script from GitHub. This mismatch is dangerous because it can mislead reviewers and users into trusting the skill for one purpose while it actually introduces an unrelated and higher-risk code execution path.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash construct turns fetched remote content into immediately executed shell code, eliminating any review or integrity gate between download and execution. In this skill context, that is especially risky because the file is an installer whose purpose is to place executable scripts in the user's PATH, so any upstream compromise could achieve persistent code execution and user-level backdoor installation.

Content

Scanner excerpt · install.sh (reported line 2)May include surrounding context.

sh
#!/usr/bin/env bash
# watchclaw installer — curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash
set -euo pipefail

REPO="jarvis4wang/watchclaw"

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md
git clone https://github.com/jarvis4wang/watchclaw.git
cd watchclaw

# Create your config
cp watchclaw.conf.example watchclaw.conf
vim watchclaw.conf   # Set GATEWAY_PORT, GATEWAY_CONFIG_DIR, alerts, etc.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill exposes shell-based installation capability but does not declare any explicit tool scope or permissions boundaries. That makes the trust model unclear and increases the chance that an agent or user will approve shell execution without understanding the risk surface, especially because the skill also includes remote-script execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Piping a remote script directly into bash gives immediate code execution to whatever content is served at that URL at install time. If the upstream repository, GitHub account, branch, or network path is compromised, users may execute arbitrary malicious code with their local privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installation instructions present a remote script pipeline into bash without any warning about the risks of arbitrary code execution. This omission lowers user caution and makes unsafe installation more likely, especially for a skill whose stated purpose does not require users to expect installer-level shell trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes automatic git stash and git revert recovery actions but does not clearly warn that these operations can alter repository state and potentially discard or complicate local work. In the context of a config repo, automatic destructive recovery can create operational outages, loss of uncommitted changes, or difficult-to-audit state changes.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Fetching and executing an external script from a live URL creates a supply-chain and arbitrary-code-execution risk. Because the content is not embedded, pinned, or integrity-checked in this skill, users cannot reliably audit what will run at the moment of installation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
{
              "id": "curl",
              "kind": "shell",
              "command": "curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash",
              "bins": ["watchclaw"],
              "label": "Install watchclaw (curl)",
            },

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The installer explicitly encourages execution via curl ... | bash, which causes users to run remote code directly from a mutable network source without inspecting or verifying it first. Although this appears to be a common convenience pattern rather than malicious behavior, it is dangerous because a compromised GitHub account, repository, branch, or delivery path would result in immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · install.sh (reported line 2)May include surrounding context.

sh
#!/usr/bin/env bash
# watchclaw installer — curl -fsSL https://raw.githubusercontent.com/jarvis4wang/watchclaw/main/install.sh | bash
set -euo pipefail

REPO="jarvis4wang/watchclaw"

Static analysis

No suspicious patterns detected.