Security audit

Gateway Watchdog Lite

Security checks for vulnerabilities and agentic risk

Overview

This watchdog largely does what it says, but its installers can turn unvalidated setup values into persistent user-level shell or service execution risks.

Review or patch the installers before installing. At minimum, validate OC_PORT as a numeric port, restrict TELEGRAM_ID to the expected format, avoid unusual or attacker-controlled workspace paths and environment variables, move state/log files out of shared /tmp, and remove the Linux pkill fallback unless the target process can be identified exactly. Install only if you accept a persistent user-level watchdog that restarts the gateway automatically and sends Telegram alerts when configured.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install.sh:40
Finding: Persistent Shell Command Injection Through macOS Installer Parameters
Content: View full analysis
Remediation: View remediation
65535 )); then echo "ERROR: OC_PORT must be an integer from 1 to 65535." >&2 exit 1 fi ``` - Validate `TELEGRAM_ID` against the exact format supported by the Telegram integration, such as an optional signed numeric identifier if that is the required format. - Do not generate executable shell source by performing text replacement with untrusted values. - Prefer passing validated settings as launchd environment variables and reading them at runtime. - If source generation is unavoidable, serialize values with context-appropriate Bash escaping, such as `printf '%q'`, rather than using raw `sed` replacement. - Add installation tests using quotes, backslashes, delimiters, newlines, and shell metacharacters to verify that malformed input is rejected. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install-linux.sh:32
Finding: Persistent Shell Command Injection Through Linux Installer Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.sh:55
Finding: LaunchAgent Definition Injection Through Unescaped XML Values
Content: View full analysis
"$PLIST_PATH" < Label ${LABEL} Comment OpenClaw Gateway Watchdog Lite — auto-recovers gateway if down RunAtLoad StartInterval 120 ProgramArguments /bin/bash ${WATCHDOG_SCRIPT} StandardOutPath /tmp/openclaw/gateway-watchdog.log StandardErrorPath /tmp/openclaw/gateway-watchdog-err.log EnvironmentVariables HOME ${HOME} PATH /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin PLIST ``` ### Technical Analysis `WATCHDOG_SCRIPT` is derived from the externally supplied `WORKSPACE_PATH`, while `HOME` is inherited from the execution environment. Both are inserted into an XML property list without XML escaping or rejection of control characters. Characters such as `<`, `>`, and `&` can invalidate the plist. More deliberately crafted values can close the current XML element and introduce additional launchd keys or arguments. If launchd accepts the resulting property list, an attacker may alter the executable or arguments associated with the persistent agent. This problem is separate from ordinary shell quoting: the required encoding context is XML text content. ### Attack Path 1. A user or automation process runs the installer with a crafted `WORKSPACE_PATH` or ...[truncated 865 chars]
Remediation: View remediation
`, single quotes, and double quotes as appropriate. - Prefer generating the plist through a structured tool such as PlistBuddy, `plutil`, or a language library rather than an interpolated heredoc. - Run `plutil -lint "$PLIST_PATH"` before bootstrapping and abort if validation fails. - Use the account database rather than trusting an arbitrary inherited `HOME` value where practical. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install-linux.sh:44
Finding: Systemd User Service Injection Through Raw Heredoc Interpolation
Content: View full analysis
"$SERVICE_FILE" <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gateway-watchdog.sh:12
Finding: Predictable Shared Temporary Files Allow Symlink-Based File Modification
Content: View full analysis
> "$LOGFILE" } ``` ```bash log "Gateway probe failed (HTTP $HTTP_STATUS). Attempting recovery..." date +%s > "$RECOVERY_COOLDOWN_FILE" ``` The Linux watchdog uses the same paths and write pattern: ```bash LOGFILE="/tmp/openclaw/gateway-watchdog.log" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery" COOLDOWN_SECONDS=300 mkdir -p /tmp/openclaw ``` ```bash log "Gateway probe failed (HTTP $HTTP_STATUS). Attempting recovery..." date +%s > "$RECOVERY_COOLDOWN_FILE" ``` ### Technical Analysis Both implementations use a globally predictable directory under `/tmp` without checking its owner, permissions, or file types. `mkdir -p` succeeds when the directory already exists and does not establish that it belongs to the current user. A local attacker can create `/tmp/openclaw` before the victim starts the watchdog and place symbolic links at `gateway-watchdog.log` or `watchdog-last-recovery`. Shell output redirection follows symbolic links. Consequently, watchdog log appends or cooldown writes can modify another file that is writable by the victim. An attacker can also populate the cooldown file with manipulated data. Non-numeric data may disrupt arithmetic processing, while future timestamps can suppress recovery attempts fo ...[truncated 1036 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gateway-watchdog-linux.sh:68
Finding: Broad Process-Matching Fallback Can Terminate Unrelated User Processes
Content: View full analysis
/dev/null; then systemctl --user restart openclaw-gateway 2>/dev/null else pkill -f "openclaw.*gateway" 2>/dev/null || true sleep 3 log "WARNING: openclaw-gateway service not found — manual restart may be required" fi ``` ### Technical Analysis When `openclaw-gateway` is not active, the watchdog calls `pkill -f` with a regular expression that is matched against complete process command lines. The expression is not tied to a verified PID, cgroup, executable path, or exact service identity. Any same-user process whose command line contains `openclaw`, followed later by `gateway`, may be killed even if it is unrelated to the monitored gateway. The fallback also only terminates matching processes; it does not perform the documented full restart. A local same-user process can intentionally choose a matching command line, while ordinary tools, scripts, or maintenance operations may match accidentally. ### Attack Path 1. The health probe fails or returns an unaccepted HTTP status. 2. The expected `openclaw-gateway` user service is inactive or unavailable. 3. The watchdog enters the fallback branch. 4. `pkill -f "openclaw.*gateway"` searches all processes accessible to the user by full command line. 5. Every matching process is sent the default termination signal, including unrelated processes. 6. Repeated health failures can cause repeated termination attempts after the cooldown. ### Impact Assessment The watchdog can terminate unintended processes owned by the same user, causing denial of service, interrupted jobs, data loss in applications that do not handle termination safely, or disruption of OpenClaw-related ...[truncated 221 chars]
Remediation: View remediation
/exe` resolves to the expected executable; - the process start time matches the recorded instance. - Prefer systemd cgroup-based termination over command-line pattern matching. - If target identity cannot be established, log the condition and alert the user without terminating processes. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (44)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 101)May include surrounding context.
macOS:

bash
launchctl bootout gui/$UID/ai.openclaw.gateway-watchdog rm ~/Library/LaunchAgents/ai.openclaw.gateway-watchdog.plist

Linux:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
macOS:

bash
launchctl bootout gui/$UID/ai.openclaw.gateway-watchdog rm ~/Library/LaunchAgents/ai.openclaw.gateway-watchdog.plist

Linux:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 108)May include surrounding context.
bash
systemctl --user stop gateway-watchdog systemctl --user disable gateway-watchdog rm ~/.config/systemd/user/gateway-watchdog.service systemctl --user daemon-reload

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
bash
systemctl --user stop gateway-watchdog systemctl --user disable gateway-watchdog rm ~/.config/systemd/user/gateway-watchdog.service systemctl --user daemon-reload

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
- **GGML Metal crash** on restart — add `GGML_NO_METAL=1` to env vars - **`openclaw gateway install --force`** — use after config changes - **Bootout + bootstrap sequence** — the correct recovery pattern - **Cooldown logic** — 5 min between attempts, reset with `rm /tmp/openclaw/watchdog-last-recovery` - **Telegram alert failures** — won't block recovery (uses `|| true`)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 90)May include surrounding context.
To reset the cooldown manually (e.g. you want the watchdog to retry immediately):

bash
rm -f /tmp/openclaw/watchdog-last-recovery

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
To reset the cooldown manually (e.g. you want the watchdog to retry immediately):

bash
rm -f /tmp/openclaw/watchdog-last-recovery

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/gotchas.md (reported line 76)May include surrounding context.
To reset the cooldown manually (e.g. you want the watchdog to retry immediately):

bash
rm -f /tmp/openclaw/watchdog-last-recovery

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly promotes installing a persistent background watchdog that performs autonomous health checks, restarts services, and writes logs, but it does not prominently disclose the persistence and system-modifying behavior as a security-sensitive action. In an agent-skill ecosystem, under-warning users about resident services and automatic recovery logic increases the chance of users installing software that changes system behavior without fully informed consent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: The README references a LaunchAgent plist under the user's LaunchAgents directory, which indicates persistent execution across sessions. Persistence itself is not inherently malicious, but in a skill context it is security-relevant behavior that should be clearly disclosed and bounded because it establishes automatic execution on login.
Content: Scanner excerpt · README.md (reported line 101)May include surrounding context.
macOS:

bash
launchctl bootout gui/$UID/ai.openclaw.gateway-watchdog rm ~/Library/LaunchAgents/ai.openclaw.gateway-watchdog.plist

Linux:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
## Overview The gateway-watchdog-lite skill installs a **macOS LaunchAgent** or **Linux systemd user service** that monitors the OpenClaw gateway every **2 minutes**. If the gateway is unresponsive, it automatically runs the recovery sequence and alerts via Telegram. **Supported platforms:** - macOS (LaunchAgent) — `scripts/install.sh`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
**Supported platforms:** - macOS (LaunchAgent) — `scripts/install.sh` - Linux (systemd user service) — `scripts/install-linux.sh` ## What It Does

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file includes launchctl bootout and bootstrap commands that remove and re-register a user service, which can interrupt the running gateway and affect local service state. The section presents the commands as a recovery sequence but does not explicitly warn users that executing them will stop and reinitialize the service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script can send gateway outage and recovery status to an external Telegram recipient via the gog telegram send command, but the disclosure is only implied by an inline variable comment and not presented as a clear consent or warning mechanism. In operational environments, these alerts leak service-health metadata off-host to a third party, which can expose monitoring details, uptime patterns, and internal tool usage without explicit user awareness.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/gotchas.md (reported line 13)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/gotchas.md (reported line 19)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/gotchas.md (reported line 40)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/gotchas.md (reported line 56)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/gotchas.md (reported line 95)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/gotchas.md (reported line 117)May include surrounding context.
md
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/gateway-watchdog.sh (reported line 13)May include surrounding context.
sh
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/gateway-watchdog.sh (reported line 79)May include surrounding context.
sh
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/gateway-watchdog.sh (reported line 13)May include surrounding context.
sh
# Full version with crash loop detection: https://confuseduser.com LOGFILE="/tmp/openclaw/gateway-watchdog.log" PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PROBE_URL="http://127.0.0.1:YOUR_OC_PORT" TELEGRAM_ID="YOUR_TELEGRAM_ID" # Set to "" to disable Telegram alerts RECOVERY_COOLDOWN_FILE="/tmp/openclaw/watchdog-last-recovery"

Static analysis

No suspicious patterns detected.