Security audit
Security checks for vulnerabilities and agentic risk
The skill’s keepalive purpose is coherent, but it installs persistent background services and has unsafe configuration handling that can repeatedly run user-level shell code or overwrite local OpenClaw configuration.
Review carefully before installing. This skill will create persistent macOS LaunchAgents, run a shell recovery script every minute, restart OpenClaw Gateway, and overwrite OpenClaw configuration from a backup after repeated failures. Treat the Telegram option as sensitive credential storage, secure or avoid keepalive.conf, and prefer a version that parses config without source and requires explicit user action before updating the golden backup.
scripts/health-check-recovery.sh:21Recurring Arbitrary Command Execution Through Sourced Configuration
scripts/install.sh:61Telegram Bot Credential Stored Without Restrictive File Permissions
scripts/health-check-recovery.sh:106Unreliable Health Detection and Automatic Corruption of the Recovery Baseline
The skill reads process state, localhost port status, logs, backups, and state files as part of health monitoring, but this monitoring footprint is broader than the simple keepalive description implies. Even if operationally justified, undocumented enumeration and inspection of local state reduces user awareness and can expose sensitive operational data.
The skill reads process state, localhost port status, logs, backups, and state files as part of health monitoring, but this monitoring footprint is broader than the simple keepalive description implies. Even if operationally justified, undocumented enumeration and inspection of local state reduces user awareness and can expose sensitive operational data.
The skill reads process state, localhost port status, logs, backups, and state files as part of health monitoring, but this monitoring footprint is broader than the simple keepalive description implies. Even if operationally justified, undocumented enumeration and inspection of local state reduces user awareness and can expose sensitive operational data.
The skill reads process state, localhost port status, logs, backups, and state files as part of health monitoring, but this monitoring footprint is broader than the simple keepalive description implies. Even if operationally justified, undocumented enumeration and inspection of local state reduces user awareness and can expose sensitive operational data.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# 删除 LaunchAgent 配置文件
echo "🗑️ 删除 LaunchAgent 配置..."
rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist
rm -f ~/Library/LaunchAgents/com.openclaw.health-check.plist
# 询问是否删除备份
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# 删除 LaunchAgent 配置文件
echo "🗑️ 删除 LaunchAgent 配置..."
rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist
rm -f ~/Library/LaunchAgents/com.openclaw.health-check.plist
# 询问是否删除备份
read -p "是否删除黄金备份？(y/N) " -n 1 -r
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
echo "🗑️ 删除黄金备份..."
rm -rf ~/.openclaw/backups/golden-config
fi
# 询问是否删除日志
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
echo "🗑️ 删除黄金备份..."
rm -rf ~/.openclaw/backups/golden-config
fi
# 询问是否删除日志
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
echo "🗑️ 删除日志..."
rm -f ~/.openclaw/logs/health-recovery.log*
rm -f ~/.openclaw/logs/health-check.log*
rm -f ~/.openclaw/state/recovery-count
fi
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
if [[ $REPLY =~ ^[Yy]$ ]]; then
echo "🗑️ 删除日志..."
rm -f ~/.openclaw/logs/health-recovery.log*
rm -f ~/.openclaw/logs/health-check.log*
rm -f ~/.openclaw/state/recovery-count
fi
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo "🗑️ 删除日志..."
rm -f ~/.openclaw/logs/health-recovery.log*
rm -f ~/.openclaw/logs/health-check.log*
rm -f ~/.openclaw/state/recovery-count
fi
echo ""
The skill clearly instructs users to execute shell scripts and install persistent LaunchAgents, yet it declares no permissions or allowed tool scope. This creates a transparency and consent failure: users and any hosting platform cannot accurately understand that the skill can modify files, start background services, and run recurring shell commands.
The skill describes automatic recovery actions that can overwrite local configuration from a golden backup, restart processes, and maintain persistent agents, but it does not prominently warn about the operational impact. Automatic rollback and restart behavior can cause data loss, revert intentional configuration changes, or create service instability if triggered incorrectly.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
ls -la ~/.openclaw/backups/golden-config/
cp ~/.openclaw/backups/golden-config/openclaw.json ~/.openclaw/openclaw.json
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
ls -la ~/.openclaw/backups/golden-config/
cp ~/.openclaw/backups/golden-config/openclaw.json ~/.openclaw/openclaw.json
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
ls -la ~/.openclaw/backups/golden-config/
cp ~/.openclaw/backups/golden-config/openclaw.json ~/.openclaw/openclaw.json
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway
The skill establishes persistence via macOS LaunchAgents so it can auto-start and run health checks continuously. Persistence is a sensitive capability because it survives user sessions, continuously executes code, and can be abused or forgotten if not transparently disclosed and explicitly authorized.
└── health-check-recovery.sh # 健康检测脚本
~/Library/LaunchAgents/
├── ai.openclaw.gateway.plist # Gateway LaunchAgent
└── com.openclaw.health-check.plist # 健康检测 LaunchAgent
~/.openclaw/backups/golden-config/
The second LaunchAgent reference confirms an additional persistent background component for periodic health checks. Multiple persistent agents increase attack surface and reduce visibility if users are not clearly informed, especially when combined with auto-restart logic and config restoration.
~/Library/LaunchAgents/
├── ai.openclaw.gateway.plist # Gateway LaunchAgent
└── com.openclaw.health-check.plist # 健康检测 LaunchAgent
~/.openclaw/backups/golden-config/
└── openclaw.json # 黄金备份配置
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.openclaw/backups/golden-config
mkdir -p ~/.openclaw/logs
mkdir -p ~/.openclaw/state
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.openclaw/backups/golden-config
mkdir -p ~/.openclaw/logs
mkdir -p ~/.openclaw/state
The guide instructs users to create a LaunchAgent that automatically starts and persistently restarts a network-exposed gateway process at login. Although this appears intended for reliability, persistence mechanisms materially increase risk because they ensure the service continues running after failures and user sessions, making misconfiguration or compromise more durable.
cat > ~/Library/LaunchAgents/ai.openclaw.gateway.plist <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
This duplicate match still points to the same LaunchAgent persistence mechanism. The risk is contextual: persistent user-level service startup is not inherently malicious, but it does make any underlying gateway weakness continuously available.
cat > ~/Library/LaunchAgents/ai.openclaw.gateway.plist <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
This duplicate match still points to the same LaunchAgent persistence mechanism. The risk is contextual: persistent user-level service startup is not inherently malicious, but it does make any underlying gateway weakness continuously available.
cat > ~/Library/LaunchAgents/ai.openclaw.gateway.plist <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
This finding corresponds to the declared LaunchAgent service label for the persistent gateway. In this skill context, the persistence is intentional for availability, but such mechanisms are still security-relevant because they create durable execution and automatic recovery after termination.
cat > ~/Library/LaunchAgents/ai.openclaw.gateway.plist <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>ai.openclaw.gateway</string>
This line closes the same persistent LaunchAgent definition. The issue is not the XML itself but the operational effect: installing a persistent auto-restarting service that may keep an exposed gateway available indefinitely.
/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin EOF
No suspicious patterns detected.