OpenClaw Launcher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:00 AM UTC
• Version: 1.1.0

Overview

The launcher is coherent for starting OpenClaw, but it needs Review because it handles a local auth token, hides script execution, bypasses PowerShell policy, and leaves a background keep-alive process running.

Review this before installing. It appears intended to launch OpenClaw locally, not to steal data, but it will create persistent launcher files, read your OpenClaw token, open a token-bearing localhost URL, run a hidden PowerShell script with execution-policy bypass, and keep a WSL process alive for up to a day. Use it only if you trust the publisher and are comfortable tightening the script directory permissions, avoiding routine Administrator launches, and cleaning up or stopping the keep-alive process when not needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:150

Finding

Hidden PowerShell Execution with Execution Policy Bypass

Content

View full analysis

nul powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "%~dp0start-openclaw.ps1"' Set-Content -Path "C:\Users\\openclaw-scripts\start-openclaw.bat" -Value $batContent -Encoding ASCII ``` The accompanying instruction explicitly requires the bypass: ```text The .bat must use `-ExecutionPolicy Bypass` to allow the script to run without prompts. ``` ### Technical Analysis The generated batch launcher invokes a PowerShell script with `-ExecutionPolicy Bypass` and `-WindowStyle Hidden`. This combination disables execution-policy checks for the process and conceals script execution from the user. The target `start-openclaw.ps1` is stored in a user-writable scripts directory and is referenced by a relative path derived from `%~dp0`. The launcher does not verify the script's signature, ownership, access-control list, or cryptographic hash before execution. Consequently, any process or account capable of modifying the script can replace it with arbitrary PowerShell code that the trusted desktop shortcut will execute without policy warnings. Execution policy is not a complete security boundary, but bypassing it removes a defense-in-depth control. Hidden execution and redirection of output to `nul` further reduce the likelihood that users will notice tampering or runtime failures. ### Attack Path 1. The user follows the Skill and creates `start-openclaw.bat` and `start-openclaw.ps1` in the Windows user profile. 2. An attacker-controlled process, compromised application, or another account with write permission modifies `start-openclaw.ps1`. 3. The user launches the apparently legitimate OpenClaw desktop shortcut. 4. The batch file starts the altered script with `-ExecutionPolicy Bypass`. 5. ...[truncated 1086 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:110

Finding

Authentication Token Exposed Through Browser URL Handling

Content

View full analysis

-- cat ~/.openclaw/openclaw.json 2>&1"', '$tokenMatch = [regex]::Match($wslConfig, "[a-f0-9]{40}")', 'if ($tokenMatch.Success) {', ' $TOKEN = $tokenMatch.Value', '} else {', ' Write-Host "[ERROR] Failed to read token from WSL config"', ' exit 1', '}', '$DASHBOARD_URL = "http://localhost:18789/#token=$TOKEN"', '', '# Get WSL IP', '$wslIpRaw = cmd /c "wsl.exe --distribution Ubuntu --user -- hostname -I 2>&1"', '$wslIp = ($wslIpRaw -split " ")[0]', '', '# Setup port proxy (requires admin)', 'cmd /c "netsh interface portproxy delete v4tov4 listenport=18789 listenaddress=127.0.0.1 2>nul"', 'cmd /c "netsh interface portproxy add v4tov4 listenport=18789 listenaddress=127.0.0.1 connectport=18789 connectaddress=$wslIp protocol=tcp 2>nul"', '', '# Check and start service if needed', '$status = cmd /c "wsl.exe --distribution Ubuntu --user -- systemctl --user is-active openclaw-gateway 2>&1"', 'if ($status -ne "active") {', ' cmd /c "wsl.exe --distribution Ubuntu --user -- systemctl --user start openclaw-gateway 2>nul"', ' Start-Sleep -Seconds 3', '}', '', '# Start keep-alive via pre-created batch file (more reliable than inline Start-Process)', 'Start-Process -FilePath "cmd.exe" -ArgumentList "/c","C:\\Users\\\\openclaw-scripts\\keep-alive.bat" -WindowStyle Hidden', '', '# Open Dashboard', 'start $DASHBOARD_URL', ] ``` ### Technical Analysis The launcher reads the entire OpenClaw configuration file into a PowerShell variable, extracts the first substr ...[truncated 2348 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Default shortcut name: Ask user or use "OpenClaw"

Step 2: Create Scripts Directory

In Windows PowerShell (as user, no admin needed):

powershell

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the launcher to read an authentication token from the user's WSL config and place it into a localhost dashboard URL. Even if intended for convenience, this expands the skill from simple shortcut creation into credential handling, increasing exposure through process arguments, browser history, logs, screenshots, or shoulder-surfing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Reading a token from configuration and embedding it in a browser URL can disclose the secret through browser history, crash reports, copy/paste, screenshots, and other local artifacts. The skill provides no prominent warning or safer alternative, so users may unknowingly expose a credential while following routine setup steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The launcher runs PowerShell with ExecutionPolicy Bypass and a hidden window, reducing visible user awareness and sidestepping a built-in defense meant to discourage untrusted scripts. In a launcher skill that writes and executes local scripts, this makes misuse or later script tampering harder for a user to notice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The keep-alive batch file intentionally spawns a long-running background process (sleep 86400) to keep the gateway session alive after the launcher exits. While framed as reliability, this is persistence-like behavior that maintains a service context invisibly and could be repurposed to sustain unauthorized access or mask ongoing activity.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

In start-openclaw.ps1:

Start-Process -FilePath "cmd.exe" -ArgumentList "/c","C:\Users<WINDOWS_USER>\openclaw-scripts\keep-alive.bat" -WindowStyle Hidden

text

And pre-create `keep-alive.bat`:
```bat
@echo off
start "" /b cmd /c wsl.exe --distribution Ubuntu --user <WSL_USER> -- bash -c "sleep 86400"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file's security-oriented guidance presents the launcher as careful about sensitive handling, but the actual generated .bat explicitly uses 'powershell -ExecutionPolicy Bypass'. While not a token contradiction, this actively weakens PowerShell's policy protections and conflicts with the overall secure intent conveyed in the notes.

Content

No source excerpt is available for this finding.