Uptime Monitoring with Encrypted Energy - Know the second your OpenClaw agent goes silent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 0.2.4

Overview

This uptime monitor is purpose-aligned in concept, but it installs persistent cron execution and sends more local operational data than the setup clearly discloses.

Review carefully before installing. Only use this if you are comfortable with a hosted service receiving detailed OpenClaw operational telemetry every minute and with a persistent cron job running under your user account. Prefer a version that sends only minimal heartbeat data, stores the token outside crontab with restrictive permissions, validates the destination endpoint, and includes clear uninstall and duplicate-prevention steps.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:22

Finding

Persistent Every-Minute Cron Job Without Lifecycle Controls

Content

View full analysis

/dev/null; echo "* * * * * PATH=$HOME/.npm-global/bin:/usr/local/bin:/usr/bin:/bin ENCRYPTED_ENERGY_API_KEY= bash {baseDir}/scripts/ping.sh >/dev/null 2>&1" ) | crontab - ``` The `PATH=$HOME/.npm-global/bin:…` prefix is required — `ping.sh` calls `openclaw health --json` and `openclaw status --json`, and crontab's default PATH won't find the openclaw binary. ``` ### Technical Analysis The documented installation command modifies the user's system crontab and causes `ping.sh` to execute every minute across login sessions and system restarts where cron is active. Recurring execution is related to the declared dead-man monitoring function and is explicitly disclosed, but it nevertheless constitutes system persistence. The installation is not idempotent: each execution appends another identical entry. This can produce duplicate requests, unnecessary system activity, and violations of the stated one-request-per-minute limit. The Skill also provides no uninstall command, expiration mechanism, or managed marker through which its entry can be reliably identified and removed. Because the script location remains under the Skill directory, subsequent modification or replacement of that file would affect every future scheduled invocation. ### Attack Path 1. The user follows the setup instructions. 2. The command copies the existing crontab, appends a new every-minute task, and writes the combined configuration back with `crontab -`. 3. The cron daemon invokes the Skill script every minute independently of the original Agent session. 4. Each invocation collects local OpenClaw st ...[truncated 612 chars]

Remediation

View remediation

other

Error

• Location: scripts/ping.sh:20

Finding

Excessive Operational Telemetry Transmitted to an External Service

Content

View full analysis

/dev/null) STATUS_JSON=$(openclaw status --json --timeout 3000 2>/dev/null) ``` The generated payload includes the following operational information: ```jq { ok: ($health.ok // false), status: (if $health.ok then "live" else "down" end), version: ($status.gateway.self.version // $status.runtimeVersion), host: ( if $status.gateway.self.host or $status.os.label then { name: ($status.gateway.self.host // null), platform: ($status.os.label // null) } else null end ), gateway: { reachable: ($status.gateway.reachable // null), mode: ($status.gateway.mode // null), connectLatencyMs: ($status.gateway.connectLatencyMs // null), misconfigured: ($status.gateway.misconfigured // null) }, channels: ( [ ($health.channels // {}) | to_entries[] | channel_entry(.key; .value) ] | add // {} ), tasks: { pending: ($status.tasks.byStatus.queued | num), failed: ($status.tasks.byStatus.failed | num), lost: ($status.tasks.byStatus.lost | num), timedOut: ($status.tasks.byStatus.timed_out | num), active: ($status.tasks.active | num), total: ($status.tasks.total | num), byRuntime:($status.tasks.byRuntime // {}) }, tokenUsage: { input: ([$status.sessions.recent[]?.inputTokens] | add // 0), output: ([$status.sessions.recent[]?.outputTokens] | add // 0), cacheRead: ([$status.sessions.recent[]?.cacheRead] | add // 0), cacheWrite: ([$status.sessions.recent[]?.cacheWrite] | add // 0), total: ([$status.sessions.recent[]?.totalTokens] | add // 0) }, sessions: { count: ($status.s ...[truncated 2692 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ping.sh:11

Finding

Unvalidated Endpoint Override Can Exfiltrate the Bearer Token and Telemetry

Content

View full analysis

/dev/null 2>&1 ``` ### Technical Analysis The destination URL can be replaced through `ENCRYPTED_ENERGY_PING_URL`, but the script performs no validation of its scheme, hostname, port, or path before attaching the bearer token. A malicious or accidental configuration can therefore redirect the request to an arbitrary destination, including a plaintext HTTP endpoint or an attacker-controlled HTTPS server. The request contains both the authorization credential and the complete telemetry payload. Although the supplied cron example does not set this override, the script explicitly trusts it whenever it appears in the execution environment. Any party or configuration mechanism capable of altering the scheduled command, script environment, or wrapper invocation can exploit this behavior. ### Attack Path 1. An attacker gains the ability to influence the script's environment or scheduled command without needing to know the API key itself. 2. The attacker sets `ENCRYPTED_ENERGY_PING_URL` to a server under their control, such as `https://attacker.example/collect`. 3. Cron invokes `ping.sh`. 4. The script reads the legitimate API key from `ENCRYPTED_ENERGY_API_KEY`. 5. `curl` sends `Authorization: Bearer ` and the complete telemetry payload to the attacker-controlled URL. 6. The attacker captures the token and may reuse it to impersonate the monitored agent or submit false status information. ### Impact Assessment Successful exploitation discloses the per-agent bearer token and all co ...[truncated 304 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Bearer Token Embedded in Plaintext Crontab Configuration

Content

View full analysis

/dev/null; echo "* * * * * PATH=$HOME/.npm-global/bin:/usr/local/bin:/usr/bin:/bin ENCRYPTED_ENERGY_API_KEY= bash {baseDir}/scripts/ping.sh >/dev/null 2>&1" ) | crontab - ``` ### Technical Analysis The installation instructions place a long-lived bearer token directly into the user's persistent crontab. The token consequently becomes part of scheduler configuration and may be exposed through account inspection, administrative tooling, support diagnostics, configuration backups, or accidental sharing of crontab output. Embedding the secret inline also complicates rotation because every installed entry must be found and modified. Duplicate installation can leave multiple stale copies. The script suppresses all output, so credential or authentication failures are not visible to the user. The token is not hardcoded in the distributed project, but the prescribed deployment method stores the user's supplied secret in plaintext. ### Attack Path 1. The user pastes the per-agent bearer token into the documented installation command. 2. The complete token is persisted in the user's crontab. 3. A local process, administrator, backup operator, diagnostic collector, or attacker with access to the user's scheduler configuration reads the crontab. 4. The party extracts the bearer token. 5. The token is replayed against the monitoring API to impersonate the Agent or perform any other operations permitted by its scope. ### Impact Assessment Exploitation requires access to the user's crontab or a copy of it and does not independently provide operating-system privilege escalation. Once disclosed, the token grants the privileges assigned by the remote service, potentially including submission of forged heartbeat data and manipulation of monitoring state. The scope depend ...[truncated 83 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The stated purpose is a simple heartbeat monitor, but the instructions say ping.sh invokes openclaw health --json and openclaw status --json and posts that data to a third-party service. That creates a material mismatch between advertised behavior and actual telemetry collection, increasing the risk of users unknowingly disclosing operational and possibly sensitive environment metadata.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

c status page flips to DOWN.

Setup

1. Sign up at https://encryptedenergy.com.

2. Register an agent at https://encryptedenergy.com/agents/new — that page reveals a per-agent bearer token (the API key).

3. Schedule the ping via the user's system crontab. The gateway is not involved at run time — ping.sh is pure bash + curl, so don't route it through openclaw cron add:

   text

   ( crontab -l 2>/dev/null; echo "* * * * * PATH=$HOME/.npm-global/bin:/usr/local/bin:/usr/bin:/bin ENCRYPTED_ENERGY_API_KEY=<paste-token> bash {baseDir}/scripts/ping.sh >/dev/null 2>&1" ) | crontab -
   

   The PATH=$HOME/.npm-global/bin:… prefix is required — ping.sh calls openclaw health --json and openclaw status --json, and crontab's default PATH won't find the openclaw binary. Adjust the PATH if openclaw lives elsewhere (run which openclaw to confirm).

The cron pings http://localhost:18789/health and POSTs the result to https://encryptedenergy.com/api/v1/ping every min

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs users to run shell commands and install a cron job, yet it declares no explicit tool scope or permissions to signal that shell access and persistent scheduled execution are required. This weakens transparency and reviewability, making it easier for a skill to perform privileged local actions without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup directs users to send local health and status data to an external endpoint without a prominent warning about data disclosure, retention, or third-party access. In context, the skill is more dangerous because the transmitted content comes from local OpenClaw status/health commands, which may reveal host, session, usage, or service information beyond a mere uptime pulse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The crontab example embeds a bearer token directly in a shell command, which can lead to credential exposure through shell history, process listings, backups, screenshots, or accidental sharing of crontab contents. Because the token authenticates recurring data submission to an external service, leakage could allow unauthorized spoofed pings or abuse of the monitored agent record.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

3. Schedule the ping via the user's system crontab. The gateway is not involved at run time — ping.sh is pure bash + curl, so don't route it through openclaw cron add:

   text

   ( crontab -l 2>/dev/null; echo "* * * * * PATH=$HOME/.npm-global/bin:/usr/local/bin:/usr/bin:/bin ENCRYPTED_ENERGY_API_KEY=<paste-token> bash {baseDir}/scripts/ping.sh >/dev/null 2>&1" ) | crontab -
   

   The PATH=$HOME/.npm-global/bin:… prefix is required — ping.sh calls openclaw health --json and openclaw status --json, and crontab's default PATH won't find the openclaw binary. Adjust the PATH if openclaw lives elsewhere (run which openclaw to confirm).

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The header comment claims sensitive information is intentionally excluded, but the payload still includes potentially sensitive environment and operational details such as host name, platform, channel state, last errors, token source, task/runtime information, and session usage metrics. Misleading assurances can cause unsafe deployment decisions because users may trust the script with broader permissions than they otherwise would.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill markets itself as a heartbeat/uptime monitor, but the script transmits substantially more than liveness data: host identity, platform, gateway state, channel configuration/status, task statistics, token usage, session model/context data, and update metadata. This creates an over-collection and external disclosure risk because operators may grant the skill access expecting a minimal uptime ping, while sensitive operational telemetry is sent to a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The script performs an authenticated POST to an external endpoint, sending locally collected telemetry off-host. External transmission is expected for a monitoring integration, but in this skill context it is dangerous because the transmitted payload exceeds simple uptime data and includes operational metadata that may aid profiling, inventorying, or incident reconnaissance if the service is compromised or untrusted.

Content

Scanner excerpt · scripts/ping.sh (reported line 141)May include surrounding context.

sh

PAYLOAD='{"ok":false,"error":"payload build failed"}'
fi

curl -s --max-time 10 \
  -X POST "$PING_URL" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \