DeadClaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:10 PM UTC
• Version: 1.0.1

Overview

DeadClaw is a disclosed emergency stop tool, but it lets broad chat triggers and simple buttons shut down or restart OpenClaw resources without adequate authorization safeguards.

Install only if you are comfortable giving this skill authority to stop agents, containers, sessions, cron jobs, and user services. Before use, replace generic chat triggers with a namespaced admin-only command, restrict allowed senders/channels, require confirmation for kill and restore, protect cron backups, avoid broad process patterns, and treat Telegram bot tokens in phone shortcuts as sensitive long-lived credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Destructive shutdown can be triggered by broad, unauthenticated chat keywords

Content

View full analysis

Remediation

View remediation

`. 2. Enforce a strict allowlist of administrator user IDs and authorized private channels before invoking any script. 3. Require a second confirmation step that summarizes the processes, containers, and scheduled tasks that will be affected. 4. Use short-lived signed requests or challenge-response authentication for phone and WebChat activation. 5. Reject commands extracted from quoted, forwarded, generated, or embedded content. 6. Rate-limit destructive requests and record authenticated actor identity, channel identity, and request ID. 7. Maintain a separately secured emergency endpoint if confirmation-free operation is required. 8. Apply the same authorization controls to `restore` because recovery starts executable workloads and scheduled tasks. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: deadclaw/scripts/kill.sh:207

Finding

Packaged kill script accepts an unrestricted environment-controlled process regex

Content

View full analysis

/dev/null || true) fi # Deduplicate PIDs (guard against empty array) if [[ ${#pids[@]} -eq 0 ]]; then return fi printf '%s\n' "${pids[@]}" | sort -u ``` ```bash while IFS= read -r pid; do if [[ "$DRY_RUN" == true ]]; then log_event "DRY-RUN: Would kill PID $pid ($(ps -p "$pid" -o comm= 2>/dev/null || echo 'unknown'))" else # Send SIGTERM first (graceful), then SIGKILL after 5 seconds if still alive if kill -TERM "$pid" 2>/dev/null; then killed_pids+=("$pid") count=$((count + 1)) fi fi done <<< "$pids" # If not a dry run, wait briefly then force-kill any survivors if [[ "$DRY_RUN" == false && ${#killed_pids[@]} -gt 0 ]]; then sleep 2 for pid in "${killed_pids[@]}"; do if kill -0 "$pid" 2>/dev/null; then kill -9 "$pid" 2>/dev/null || true log_event "KILL: Force-killed stubborn process PID $pid" fi done fi ``` ### Technical Analysis `OPENCLAW_PROCESS_PATTERN` is passed directly to `pgrep -f` as a regular expression. The packaged implementation does not reject universal or excessively broad expressions such as `.*`, `.`, or other patterns that match unrelated command lines. Every matching PID is sent SIGTERM and, if still present after two seconds, SIGKILL. There is no verification that: - The executable belongs to OpenClaw - The executable path is under an expected installation directory - The process own ...[truncated 1493 chars]

Remediation

View remediation

/exe` on Linux or an equivalent canonical executable path and verify it belongs to an approved OpenClaw installation. 5. Verify process ownership and expected parent/process-group relationships. 6. Explicitly exclude the current PID, parent PID, watchdog controller, shell, and OpenClaw control process unless intentionally targeted. 7. Display the complete target list and require confirmation when a custom pattern is used. 8. Add a maximum target count and abort if it is exceeded. 9. Consolidate the duplicate script trees so that validation cannot diverge between source and packaged copies. 10. Add automated tests proving that `.*`, `.`, `^`, and unrelated application names cannot select processes. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/restore.sh:229

Finding

Restore operation starts services and containers that DeadClaw did not prove it stopped

Content

View full analysis

/dev/null || true log_event "Re-enabled launchd agent: $(basename "$plist")" restored_items=$((restored_items + 1)) done elif [[ "$os" == "Linux" ]]; then while IFS= read -r service; do [[ -n "$service" ]] || continue local svc_name svc_name=$(echo "$service" | awk '{print $1}') systemctl --user enable "$svc_name" 2>/dev/null || true systemctl --user start "$svc_name" 2>/dev/null || true log_event "Re-enabled systemd service: ${svc_name}" restored_items=$((restored_items + 1)) done < <(systemctl --user list-unit-files --type=service 2>/dev/null | grep -i "openclaw\|claw-agent\|clawdbot\|moltbot" | grep "disabled" || true) fi # Restart stopped Docker containers local stopped_containers stopped_containers=$(find_stopped_containers) if [[ -n "$stopped_containers" ]]; then while IFS= read -r container; do [[ -n "$container" ]] || continue docker start "$container" &>/dev/null || true log_event "Restarted Docker container: ${container}" echo "Docker container restarted: ${container}" restored_items=$((restored_items + 1)) done <<< "$stopped_containers" fi ``` The stopped-container selector used by this code is: ```bash docker ps -a --filter "name=openclaw" --filter "status=exited" --format "{{.Names}}" 2>/dev/null || true ``` ### Technical Analysis The kill operation does not create a per-event manifest recording exactly which launchd agents, systemd services, and Docker containers were active and changed by DeadCl ...[truncated 1899 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kill.sh:273

Finding

Full crontab is backed up with inherited permissions and later restored wholesale

Content

View full analysis

/dev/null; then crontab -l > "$backup_file" 2>/dev/null || true log_event "CRON: Crontab backed up to ${backup_file}" # Count OpenClaw-related cron entries cron_count=$(grep -c -i "openclaw\|claw-agent\|clawdbot\|moltbot" "$backup_file" 2>/dev/null || true) cron_count=${cron_count:-0} if [[ "$DRY_RUN" == true ]]; then log_event "DRY-RUN: Would remove ${cron_count} OpenClaw cron entries" else crontab -l 2>/dev/null | grep -v -i "openclaw\|claw-agent\|clawdbot\|moltbot" | crontab - 2>/dev/null || true log_event "CRON: ${cron_count} OpenClaw cron entries removed" fi fi ``` ```bash # Restore crontab if [[ -n "$backup_file" && -f "$backup_file" ]]; then crontab "$backup_file" 2>/dev/null if [[ $? -eq 0 ]]; then log_event "Crontab restored from ${backup_file}" echo "Crontab restored." restored_items=$((restored_items + 1)) else log_event "Failed to restore crontab from ${backup_file}" echo "Warning: Failed to restore crontab." fi fi ``` ### Technical Analysis The script creates the backup directory and backup file without setting a restrictive `umask` or explicit permissions. The resulting access mode depends on the caller's environment. Crontabs commonly contain: - API tokens - Passwords embedded in URLs - Cloud credentials - Environment variables - Sensitive filesystem paths - Operational command details The complete crontab is copied even though the shutdown operation only remove ...[truncated 1502 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/android-widget-guide.md:40

Finding

Android shortcut instructions place a long-lived Telegram bot token in third-party app configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (125)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

thing: stops everything. Designed for anyone to set up in under five minutes and activate from their phone lock screen.

---

The Four Scripts

kill.sh — The Panic Button

Shuts everything down immediately:

• Kills all OpenClaw agent processes (SIGTERM, then SIGKILL for anything stubborn)
• Stops all OpenClaw Docker containers (kills sessions inside first, then stops)
• Backs up your crontab to a timestamped file, then removes OpenClaw cron entries
• Pauses launchd agents (macOS) or systemd services (Linux)
• Logs everything to deadclaw.log
• Sends confirmation back to the triggering channel

bash

bash scripts/kill.sh              # Kill everything
bash scripts/kill.sh --dry-run    # See what WOULD happen without killing

status.sh — The Dashboard

Shows what's running. Read-only, safe to run anytime.

bash

bash scripts/status.sh            # Human-readable report
bash scripts/status.sh --json     # Machine-readable output

Example output:

text

Dead

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented trigger phrases include very short and common terms like "kill" and "dead," which are prone to accidental activation in normal conversation or message history replay. Because the action halts agents, stops containers, and alters scheduling, unintended triggering can cause immediate service interruption and operational disruption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code largely matches the declared core kill-switch behavior: stopping agents/processes, pausing scheduled jobs, killing sessions, logging, and handling Docker/native installs. However, the description claims additional major capabilities not present in this code chunk, especially the background watchdog with policy-based auto-kill conditions and explicit trigger mechanisms such as message/button/shortcut handling. This script only accepts CLI flags/environment context for logging and executes the kill sequence when run; it does not itself implement those trigger surfaces or the watchdog detection logic. Because those are substantial declared behaviors rather than minor supporting details, this is a description/behavior mismatch for the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an emergency stop/kill-switch capability that shuts down agents and automatically terminates unsafe activity. The supplied code does the opposite operationally: it is a recovery script intended to bring services back online after a kill event. Its primary purpose is restoration, not halting. It accesses and modifies scheduling/service state by restoring crontab entries, enabling services, starting containers, and restarting gateway/watchdog processes—capabilities not represented in the description. While logging is mentioned in both, that overlap is incidental and does not align the primary behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a kill switch with active intervention capabilities: stopping agents, pausing scheduled jobs, killing sessions, logging shutdown actions, and automatically terminating agents under unsafe conditions. The supplied code does none of that. It is a status/health report script that inspects running processes and Docker containers, reads token metrics, checks whether a watchdog process appears active, and prints human-readable or JSON status. Its own header explicitly describes it as a health report and says it is triggered by a user sending "status." This is a material description-behavior mismatch because the code’s primary purpose is observational monitoring, not emergency shutdown or enforcement.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code substantially matches the watchdog portion of the description: it runs a background monitor, checks runtime, token usage, network destinations, and file writes, logs events, and auto-triggers a kill action. However, the declared purpose presents the skill primarily as a full emergency kill switch that can be manually triggered through several user-facing mechanisms and that directly halts agents, pauses jobs, and kills sessions. None of those manual trigger paths appear in this code chunk, and the actual stopping behavior is not implemented here but handed off to an external kill.sh script. Because the chunk's concrete behavior is narrower than the declared end-user description and omits key declared capabilities, this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code largely matches the core kill-switch behavior: it kills OpenClaw processes, stops Docker containers, pauses scheduled jobs, kills sessions, and logs the incident. However, the declared description materially overstates capabilities not present in this code chunk, especially the watchdog that detects and auto-kills on specific safety conditions. The script only stops a separate watchdog.sh; it does not implement watchdog monitoring itself. It also does not implement the declared trigger surfaces (message/button/shortcut) in this chunk. In the other direction, the code performs some capabilities not clearly declared, notably sending a confirmation message back to a channel and disabling/stopping systemd or launchd services in addition to editing cron. Overall, this is a description/behavior mismatch because important declared capabilities are absent from the provided code and there are a few undeclared operational behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on an emergency stop/kill-switch capability with watchdog-based automatic shutdown behavior. The supplied code does the opposite operationally: it is a recovery script intended to bring systems back online after a kill event. Its primary actions are restoration and restart of cron jobs, services, containers, and the gateway. Although it belongs to the same DeadClaw skill family and references post-kill safety, the actual behavior of this code chunk is materially different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a safety-critical kill switch whose main function is to immediately stop agents and enforce automatic shutdowns under dangerous conditions. The supplied code does none of that. It is a status.sh script that collects and prints operational status for native processes and Docker containers, reads token metrics, checks whether a watchdog PID appears active, and emits warnings when thresholds are being approached. It is explicitly read-only (--dry-run is noted as identical because status is already read-only), and there are no commands to terminate processes, pause jobs, kill sessions, or enforce watchdog actions. The trigger described in comments is also different: the script is meant for a 'status' request, not an emergency stop. This is a clear description-behavior mismatch with a materially different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code aligns with the watchdog portion of the description: it monitors runtime, token usage, network connections, and file writes, logs events, and auto-triggers a kill action. However, the declared purpose presents a broader skill centered on an emergency kill switch with manual trigger paths and direct stoppage of agents/jobs/sessions. None of those manual trigger mechanisms are implemented in this code chunk, and the actual stopping behavior is delegated to another script not shown here. Because the provided code covers only part of the declared functionality and omits key advertised trigger methods and shutdown actions, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger list includes broad terms like 'kill', 'dead', 'status', and 'restore', which are common in ordinary conversation and likely to collide with unrelated user messages. In a skill designed to halt agents, stop containers, and alter scheduling, accidental activation could cause immediate denial of service and unsafe operational disruption.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The keyword list is dangerously collision-prone, especially because it contains generic operational words and even emoji that may appear in normal chat. Given the skill's destructive authority over processes, jobs, containers, and sessions, an attacker or even an innocent user could trigger a platform-wide shutdown with trivial input.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Single-word message triggers without exclusion rules, authentication, or confirmation create a highly exploitable kill-switch interface. Any user who can send messages on a connected channel—or any malicious prompt/content that causes those words to appear—could induce mass shutdown of agents, session termination, and scheduler interruption.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented trigger set includes very broad, common words like "kill", "dead", and "stop everything", and states they work from any connected channel. That creates a realistic risk of accidental or spoofed activation through ordinary conversation, forwarded messages, or untrusted participants, causing a full shutdown of running agents and scheduled jobs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation and setup text presents message-triggered remote kill capability as immediately available, but does not clearly warn users that installing the skill exposes a destructive control path across connected messaging channels. That omission can cause operators to enable a remotely invocable kill switch without understanding the attack surface or accidental-trigger risk.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger list includes extremely common terms such as kill, dead, and status, which can appear in ordinary conversation and could unintentionally invoke destructive actions. Because this skill is designed to halt agents, pause jobs, and kill sessions across connected channels, accidental or spoofed activation could cause widespread denial of service and operational disruption.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · deadclaw/docs/android-widget-guide.md (reported line 51)May include surrounding context.

md

(Replace `YOUR_CHAT_ID_HERE` with your numeric chat ID)
5. Tap the back arrow to save

<!-- SCREENSHOT_PLACEHOLDER: tasker-http-request.png -->

### A4: Test the Task

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · deadclaw/docs/android-widget-guide.md (reported line 86)May include surrounding context.

md

Open the Google Play Store, search for **HTTP Shortcuts** (by Roland Meyer), and install it. It's free.

<!-- SCREENSHOT_PLACEHOLDER: http-shortcuts-playstore.png -->

### B2: Create a New Shortcut

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · deadclaw/docs/android-widget-guide.md (reported line 116)May include surrounding context.

text

   Replace `YOUR_CHAT_ID_HERE` with your numeric Telegram chat ID.

<!-- SCREENSHOT_PLACEHOLDER: http-shortcuts-body.png -->

### B5: Set the Icon

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented message trigger is the single word "kill" sent to any connected channel, which is highly collision-prone in normal conversation and can be invoked accidentally or by anyone able to post in those channels. In a kill-switch skill, unintended activation causes immediate denial of service by terminating agents, pausing jobs, and killing sessions, making the broad trigger especially dangerous in this context.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · deadclaw/docs/iphone-shortcut-guide.md (reported line 24)May include surrounding context.

md

If you can't find it, swipe down on your home screen to open search, then type "Shortcuts" and tap it.

<!-- SCREENSHOT_PLACEHOLDER: shortcuts-app-icon.png -->

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · deadclaw/docs/iphone-shortcut-guide.md (reported line 73)May include surrounding context.

md

- Choose **Text** as the type
   - Enter the key name and value

<!-- SCREENSHOT_PLACEHOLDER: configure-url-action.png -->

---

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "from a friend's phone, from anywhere" implies that a destructive stop action may be triggered remotely without strong proof of identity or device binding. For a kill-switch skill, unauthenticated or weakly authenticated remote invocation creates a direct denial-of-service path where any party able to send the trigger can halt agents, pause jobs, and disrupt operations.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using the single word "kill" as a message trigger is dangerously broad and likely to collide with normal conversation, jokes, quoted text, or incident discussion. In a multi-channel environment, accidental activation could stop all running agents and pause scheduled tasks, producing self-inflicted denial of service.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents message-triggered stopping across connected channels as convenient, but does not clearly warn that this can halt agents and pause cron jobs through chat interfaces that may be broadly accessible or insufficiently trusted. Missing safety warnings around destructive remote controls increase the likelihood of insecure deployment and accidental or unauthorized service disruption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.