hybrid-gateway

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 1.1.0

Overview

This skill is a security-focused setup guide for pairing an OpenClaw gateway with a local node, and the sensitive actions it describes are disclosed, scoped, and purpose-aligned.

Install only if you intend this machine to participate in a hybrid OpenClaw setup. Treat join links and Gateway tokens as secrets, verify the pending node request before approval, keep exec allowlists narrow, and remember that running the node as a service gives the Gateway ongoing access to the capabilities you approve.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

openclaw devices join-code --json # prints {"joinUrl": "https://…/j/", "command": "…"}

text

Put only the `joinUrl` value into a private file on the node (for example `~/join.txt`, `chmod 600`), not the JSON document. The link is single-use and expires. Never relay it through a chat transcript.

**Done when:** the join URL exists in that one file on the node and nowhere in chat or shell history.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

**B. Foreground proof first:** run `openclaw connect --target-file ~/join.txt --display-name "Mac Mini"` without `--service`, watch it register, stop it, then return to Step 2, mint a fresh link, and run A with that fresh file.

The service form writes `~/Library/LaunchAgents/ai.openclaw.node.plist` on macOS or a systemd user unit on Linux; the node log is `~/Library/Logs/openclaw/node.log` on macOS.

**Done when:** `openclaw node status` on the node shows the service running, and `openclaw nodes pending` on the VPS shows one new request from it.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/upgrade-notes.md (reported line 6)May include surrounding context.

md

Order: Gateway first, then each node. A node may run the previous supported release (N-1) until it is upgraded.

1. **Stop, then check config.** 2026.9 refuses to start on an invalid config. With the Gateway stopped, run `openclaw doctor --fix`; it migrates renamed keys (`env.*` to `env.vars`, exec `security: ask` to `mode`).
2. **Service files.** `openclaw gateway install --force` refuses group-writable `~/.config`, `~/.config/systemd`, `~/.config/systemd/user`, and unit files. `chmod 755` the directories and `644` the unit first.
3. **Plugins.** Pinned plugin versions do not follow the core upgrade: `openclaw plugins install @openclaw/<plugin>@latest` for each.
4. **Proxy list.** Keep `gateway.trustedProxies` narrow (the same-host Serve proxy only). A wide list rejects nodes with `403 Proxy client attribution is required`.
5. **Node reapproval.** After the node upgrades it advertises new capabilities and files a reapproval request. `openclaw nodes describe --node <name>` lists current vs pending caps and commands; existing caps keep working. Approve with `openclaw nodes approve <request-id>` (needs `operator.admin`) only if the workflow needs the new surface.