Back to skill
Skillv1.1.0
ClawScan security
Termux Persistent Gateway · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 1:37 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The scripts and instructions are internally consistent with the stated purpose (keeping a gateway persistent on Termux) and do not request unrelated credentials, download remote code, or perform unexplained actions.
- Guidance
- This skill appears to do what it says: keep a gateway running on Termux. Before installing or enabling it, do the following: (1) Edit GATEWAY_CMD in scripts/run-gateway.sh to the exact command you intend to run (do not leave it pointed at an untrusted binary); (2) Review ~/.profile that will be sourced by the boot script — remove or inspect any commands you would not want run at boot; (3) Understand it will acquire a wake lock (will keep CPU awake and impact battery) and require granting Termux/Termux:API permissions and setting Termux battery to Unrestricted; (4) If you schedule the healthcheck, ensure the cron job path points to the correct script location; (5) Do not include sensitive credentials in the gateway command or its arguments, since that process will run persistently. If you want extra safety, run the gateway command manually first and confirm expected behavior before enabling auto-boot/cron.
Review Dimensions
- Purpose & Capability
- okName/description (persistent Termux gateway) matches the included files and instructions: tmux session management, termux-wake-lock, termux-boot auto-start, and a simple healthcheck. The default GATEWAY_CMD is a reasonable placeholder; the skill instructs users to edit it to their real gateway command.
- Instruction Scope
- noteSKILL.md and scripts stick to launching and monitoring a gateway process. The only potentially sensitive action is that the boot script sources ~/.profile to restore PATH/venv, which can execute whatever the user’s profile contains — this is necessary to ensure the gateway binary is on PATH but means the boot-time execution environment inherits user dotfile behavior. No external endpoints or secret exfiltration are referenced.
- Install Mechanism
- okInstruction-only with bundled scripts; there is no network download or package install performed by the skill itself. Required third-party packages (tmux, termux-api, termux-boot) are reasonable and documented.
- Credentials
- okThe skill declares no required environment variables or credentials and the scripts do not attempt to access unrelated secrets or config paths. It uses ~/ .agent for logs and scripts — a local, proportional choice.
- Persistence & Privilege
- okThe skill does not request always:true and does not modify other skills. It installs an optional Termux:Boot script to auto-start the gateway (expected for the stated goal). Note that the gateway process will hold a wake lock and can run autonomously once configured — this is the intended behavior.