OpenClaw 维护脚本

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:02 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent OpenClaw maintenance bundle, but its Linux service guidance can create an unsafe root-level watchdog setup.

Review the scripts before installing, do not run the README's Linux systemd unit as root against a script in a user-writable home directory, protect any .env file that contains CLASH_SECRET or notification targets, and confirm you are comfortable with automatic gateway restarts, proxy changes, and log deletion.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: README.md:81

Finding

Root systemd service executes a user-writable script

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 81-98
Vulnerability Type: Local privilege escalation through an unsafe systemd service configuration
Risk Level: High

Vulnerable Code

ini

[Unit]
Description=OpenClaw Gateway Watchdog
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash /home/<user>/.openclaw/scripts/gateway-watchdog.sh
Restart=always

[Install]
WantedBy=multi-user.target

bash

sudo systemctl daemon-reload
sudo systemctl enable --now openclaw-watchdog

Technical Analysis

The documented systemd unit does not specify a User= or Group= directive. A system-level service installed under /etc/systemd/system therefore runs as root by default.

At the same time, ExecStart points to a script under a regular user's home directory:

text

/home/<user>/.openclaw/scripts/gateway-watchdog.sh

The installation script copies this file into the user's directory, where it ordinarily remains writable by that user. This creates a privilege-boundary violation: privileged systemd executes code controlled by an unprivileged account.

Continuous service registration is relevant to the declared watchdog functionality, but root execution is unnecessary. The watchdog only needs to make a local HTTP request, write user-scoped logs and a lock file, invoke OpenClaw, and send notifications.

Attack Path

1. An administrator follows the documented instructions and creates the system-level unit in /etc/systemd/system/openclaw-watchdog.service.
2. The administrator enables the unit with sudo systemctl enable --now openclaw-watchdog.
3. Because the unit has no User= directive, systemd runs it as root.
4. The owner of /home/<user>/.openclaw/scripts/gateway-watchdog.sh, or an attacker who compromises that account, modifies the script to include arbitrary commands.
5. The service is restarted, crashes and is automatically restarted, or starts during a subsequent boot.
6. systemd execu ...[truncated 674 chars]

Remediation

View remediation

Remediation Suggestions

1. Run the service as a dedicated, unprivileged account:

ini

[Service]
Type=simple
User=openclaw-watchdog
Group=openclaw-watchdog
ExecStart=/usr/local/lib/openclaw-maintenance/gateway-watchdog.sh
Restart=always
NoNewPrivileges=true

2. Install executable service code in a root-owned directory rather than a user's home directory:

bash

sudo install -d -o root -g root -m 0755 /usr/local/lib/openclaw-maintenance
sudo install -o root -g root -m 0755 \
  gateway-watchdog.sh \
  /usr/local/lib/openclaw-maintenance/gateway-watchdog.sh

3. Ensure the dedicated service account and other unprivileged users cannot modify the script, its parent directory, or the systemd unit.

4. Grant only the narrowly scoped permission required to restart the Gateway. Prefer a user-scoped OpenClaw service. If elevated control is unavoidable, use a tightly constrained privileged helper or sudoers rule for one fixed command instead of running the entire watchdog as root.

5. Add applicable systemd hardening directives, for example:

ini

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
ReadWritePaths=/var/log/openclaw-watchdog /run/openclaw-watchdog

6. Document ownership and permission requirements and verify them before enabling the service. Refuse startup if the executable or its parent directories are writable by the service user or unrelated accounts.

7. After changing the unit, reload systemd and inspect the effective identity and security posture:

bash

sudo systemctl daemon-reload
sudo systemctl restart openclaw-watchdog
systemctl show openclaw-watchdog -p User -p Group
systemd-analyze security openclaw-watchdog.service

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (58)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AGENT.md (reported line 6)May include surrounding context.

md

> **复制给你的 Agent 的提示词（Prompt）**：
> ```
> 你需要在目标机器部署 OpenClaw 维护脚本。请在仓库根目录执行：
> 1) 复制环境变量示例：cp .env.example .env
> 2) 填写 .env（至少设置 OPENCLAW_NOTIFY_TARGET、CLASH_API/CLASH_SECRET 如需）
> 3) 运行安装脚本：bash install.sh
> 4) 运行自检：bash check.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AGENT.md (reported line 19)May include surrounding context.

md

> **复制给你的 Agent 的提示词（Prompt）**：
> ```
> 你需要在目标机器部署 OpenClaw 维护脚本。请在仓库根目录执行：
> 1) 复制环境变量示例：cp .env.example .env
> 2) 填写 .env（至少设置 OPENCLAW_NOTIFY_TARGET、CLASH_API/CLASH_SECRET 如需）
> 3) 运行安装脚本：bash install.sh
> 4) 运行自检：bash check.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

> **复制给你的 Agent 的提示词（Prompt）**：
> ```
> 你需要在目标机器部署 OpenClaw 维护脚本。请在仓库根目录执行：
> 1) 复制环境变量示例：cp .env.example .env
> 2) 填写 .env（至少设置 OPENCLAW_NOTIFY_TARGET、CLASH_API/CLASH_SECRET 如需）
> 3) 运行安装脚本：bash install.sh
> 4) 运行自检：bash check.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

> **复制给你的 Agent 的提示词（Prompt）**：
> ```
> 你需要在目标机器部署 OpenClaw 维护脚本。请在仓库根目录执行：
> 1) 复制环境变量示例：cp .env.example .env
> 2) 填写 .env（至少设置 OPENCLAW_NOTIFY_TARGET、CLASH_API/CLASH_SECRET 如需）
> 3) 运行安装脚本：bash install.sh
> 4) 运行自检：bash check.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 8)May include surrounding context.

sh

> **复制给你的 Agent 的提示词（Prompt）**：
> ```
> 你需要在目标机器部署 OpenClaw 维护脚本。请在仓库根目录执行：
> 1) 复制环境变量示例：cp .env.example .env
> 2) 填写 .env（至少设置 OPENCLAW_NOTIFY_TARGET、CLASH_API/CLASH_SECRET 如需）
> 3) 运行安装脚本：bash install.sh
> 4) 运行自检：bash check.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AGENT.md (reported line 18)May include surrounding context.

Minimal Steps

bash

cp .env.example .env
# 编辑 .env
bash install.sh
bash check.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The README instructs creation and population of a .env file with values including CLASH_SECRET and notification target information, which introduces local credential handling. While this is common operational practice, the documentation does not warn about securing the file, avoiding commits, or restricting permissions, creating a realistic risk of credential exposure.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

> **复制给你的 Agent 的提示词（Prompt）**：
> ```
> 你需要在目标机器部署 OpenClaw 维护脚本。请在仓库根目录执行：
> 1) 复制环境变量示例：cp .env.example .env
> 2) 填写 .env（至少设置 OPENCLAW_NOTIFY_TARGET、CLASH_API/CLASH_SECRET 如需）
> 3) 运行安装脚本：bash install.sh
> 4) 运行自检：bash check.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

| `proxy-health.sh` | 代理网络监控 | 每分钟 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check.sh (reported line 5)May include surrounding context.

sh

set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENV_FILE="$ROOT_DIR/.env"

if [[ ! -f "$ENV_FILE" ]]; then
  echo "[ERROR] .env not found. Run: cp .env.example .env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 5)May include surrounding context.

sh

set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENV_FILE="$ROOT_DIR/.env"

if [[ ! -f "$ENV_FILE" ]]; then
  echo "[ERROR] .env not found. Run: cp .env.example .env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 8)May include surrounding context.

sh

set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENV_FILE="$ROOT_DIR/.env"

if [[ ! -f "$ENV_FILE" ]]; then
  echo "[ERROR] .env not found. Run: cp .env.example .env"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quickstart directs an agent to execute install and check scripts and mentions LaunchAgent/systemd persistence without warning about system modification, startup persistence, or the need to inspect the scripts first. In an agent skill context, this increases the risk of blind execution of potentially harmful or persistence-establishing code on the target machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document content begins in Chinese and consistently presents all operating instructions, warnings, and examples only in Chinese. This imposes a language choice on users without opt-in or an explanation that the skill is intended for a Chinese-only or region-specific audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README-proxy-health.md (reported line 89)May include surrounding context.

md

CLASH_SECRET="set-your-secret"

# 获取当前节点
curl -H "Authorization: Bearer $CLASH_SECRET" "$CLASH_API/proxies/GLOBAL"

# 测试节点延迟
curl -H "Authorization: Bearer $CLASH_SECRET" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README-proxy-health.md (reported line 176)May include surrounding context.

ps aux | grep verge-mihomo

测试 API

curl -H "Authorization: Bearer set-your-secret" http://127.0.0.1:9097/proxies

text

### 节点切换失败

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly instructs an agent to copy configuration, run an install script, and execute a self-check on a target machine, while later describing capabilities that can restart services, switch proxy nodes, and delete logs. Because these side effects are not clearly disclosed in the initial deployment prompt, an operator or autonomous agent could execute privileged or disruptive actions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description advertises automatic service restarts, automatic VPN/proxy node switching, and automatic log deletion, all of which can affect system integrity, connectivity, or retained data. The README does not include an explicit warning that these actions are automatic and may interrupt services, alter network routing, or remove historical logs.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

Linux

使用 systemd 或 cron：

bash

sudo systemctl enable --now openclaw-watchdog

NAS

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

Linux

使用 systemd 或 cron：

bash

sudo systemctl enable --now openclaw-watchdog

NAS

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 166)May include surrounding context.

Linux

使用 systemd 或 cron：

bash

sudo systemctl enable --now openclaw-watchdog

NAS

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

Linux

使用 systemd 或 cron：

bash

sudo systemctl enable --now openclaw-watchdog

NAS

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

Linux

使用 systemd 或 cron：

bash

sudo systemctl enable --now openclaw-watchdog

NAS

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

Linux

使用 systemd 或 cron：

bash

sudo systemctl enable --now openclaw-watchdog

NAS

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script automatically sources a local .env file, which executes any shell syntax contained in that file in the current process context. Because .env is treated as code rather than parsed as data, a malicious or modified .env can run arbitrary commands whenever the check script is invoked, making this a real code-execution risk rather than a simple configuration convenience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing comments and printed messages are entirely in Chinese, which imposes a specific language/locale in the skill's natural-language interface. The file does not indicate that the skill is region-specific or provide any opt-in or fallback for other languages.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.