Gateway Watchdog Discord

• Outcome: Review
• Latest audit: Aug 3, 2026 · 5:10 PM UTC
• Version: 1.0.4

Overview

The watchdog mostly matches its stated monitoring purpose, but it can repeatedly send a Spark API token to any configured Spark URL, so it needs user review before installation.

Install only if you control the configuration. Keep SPARK_API_URL on loopback or a trusted internal host, avoid placing sensitive Spark tokens in ~/.openclaw/.env for this watchdog unless URL validation is added, use a private Discord destination, and review any cron or LaunchAgent entry because it will run unattended.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill advertises and instructs shell execution (`bash`, `openclaw`, `curl`) but does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or tooling may underestimate the skill's ability to execute local commands, install persistence, and access local/network resources.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: gateway-watchdog
description: Monitor the OpenClaw Gateway plus configured Spark, Local API Hub, and Dashboard loopback health endpoints with a read-only watchdog state machine, local state files, cooldown dedupe, and optional Discord alerts on macOS. Use for explicitly configured foreground checks, cron execution, LaunchAgent installation, recovery notification, and low-noise incident reporting; it does not rewrite OpenClaw config or restart services.
metadata:
  openclaw:
    version: "1.0.4"

• Confidence: 72% confidence
• Finding: The skill description explicitly supports cron execution, LaunchAgent installation, and writes persistent state under the user's home directory. Even though it claims to be read-only with respect to OpenClaw config, it still establishes recurring execution and durable local state, which is a form of session persistence that can outlive the initiating session.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `scripts/gateway-watchdog.sh` - health checks + state machine + Discord notification.
- `scripts/install-launchd.sh` - installs a user LaunchAgent from template.
- `references/com.openclaw.gateway-watchdog.plist.template` - launchd template.
- `references/cron-agent-turn.md` - isolated cron prompt template.

## Health checks

• Confidence: 88% confidence
• Finding: The documented `install-launchd.sh` and LaunchAgent plist template indicate the skill can install a macOS LaunchAgent, giving it automatic recurring execution in the user context. Persistence is security-relevant because a compromised or modified watchdog script would continue running and could repeatedly access local services or exfiltrate incident data via Discord.

External Script Fetching

High

• Category: Supply Chain

Content

curl_args+=(-H "Authorization: Bearer ${spark_token}")
  fi

  if ! response=$(curl "${curl_args[@]}" "${spark_api}/status" 2>/dev/null); then
    echo "fail"
    return
  fi

• Confidence: 89% confidence
• Finding: The script performs an authenticated request to a configurable SPARK_API_URL and automatically attaches a bearer token read from configuration or ~/.openclaw/.env. If an attacker can influence SPARK_API_URL, they can redirect the request to an attacker-controlled host and capture the token, turning a simple health check into credential exfiltration. The watchdog context increases risk because this may run unattended via cron or LaunchAgent, repeatedly leaking credentials without user visibility.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.