Async Queue

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:17 PM UTC
• Version: 1.0.6

Overview

This delayed-task skill is mostly transparent about what it installs, but it creates a persistent local daemon and a plugin route that can inject arbitrary queued task text into agent system events.

Install only if you are comfortable running a persistent user-level OpenClaw daemon that can wake agents and deliver queued text as system events. Review who can write ~/.openclaw/queue files and who can call authenticated local plugin routes, define allowed targets carefully, and be prepared to manually unload and remove the LaunchAgent and copied files if you stop using it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: scripts/install.sh:45

Finding

Persistent LaunchAgent Runs the Queue Daemon Across User Sessions

Content

View full analysis

"$PLIST" < Label ai.openclaw.queue-daemon ProgramArguments /usr/bin/env node ${QUEUE_DIR}/daemon.js RunAtLoad KeepAlive StandardOutPath ${QUEUE_DIR}/daemon.log StandardErrorPath ${QUEUE_DIR}/daemon.log PLIST_EOF launchctl unload "$PLIST" 2>/dev/null || true launchctl load "$PLIST" ``` ### Technical Analysis The manual installer creates a user LaunchAgent in `~/Library/LaunchAgents` and immediately loads it. `RunAtLoad` causes the daemon to start when the LaunchAgent is loaded or the user logs in, while unconditional `KeepAlive` causes launchd to restart the process after it exits. Persistent execution is related to the declared delayed-task functionality and is explicitly disclosed in `SKILL.md` and `public.json`. However, unconditional restart behavior grants the component durable, cross-session execution beyond a single Skill invocation. The installed program is a JavaScript file under the user's writable home directory: ```text ~/.openclaw/queue/daemon.js ``` Consequently, any process operating as the same user that replaces this file can alter the program subsequently executed and maintained by launchd. The project also provides no automated uninstall procedure to unload and remove the service. The Launch ...[truncated 1312 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: plugin/index.ts:43

Finding

Untrusted Queue Task Content Is Injected into an Agent as a System Event

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The skill is presented as a delayed file-backed scheduler, but the documented delivery flow includes installing a local plugin endpoint and using HTTP POSTs to trigger enqueueSystemEvent and requestHeartbeatNow on arbitrary agent targets. That expands the trust boundary from local file scheduling into an event-injection mechanism that can wake agents and deliver arbitrary task text, which is materially more powerful than the declared purpose and can enable misuse if the local endpoint or target mapping is abused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill manifest describes a file-backed delayed-task scheduler for coordinating agents, emphasizing 'no infra needed.' This plugin advertises an HTTP endpoint used by a daemon to wake agents, which introduces network-facing infrastructure behavior not reflected in the stated skill description and is not an obvious requirement from that description alone.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comment explicitly states that TARGETS comes from user config at ~/.openclaw/queue/targets.json, but TARGETS_PATH is actually built from path.dirname(QUEUE_PATH), which resolves relative to the script location. This is an active contradiction between documentation and implemented behavior, affecting where operators expect routing configuration to be sourced from.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes a file-backed delayed task queue for coordinating agents, which suggests local queue management as the core behavior. In addition to file-backed scheduling, the code actively delivers tasks by POSTing to a localhost HTTP endpoint, a behavior not reflected in the manifest description and broader than simple queue storage/dispatch semantics.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/PROTOCOL.md (reported line 86)May include surrounding context.

md

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/PROTOCOL.md (reported line 87)May include surrounding context.

md

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 17)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 43)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 47)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 48)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 67)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 17)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 45)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 47)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 71)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)"
QUEUE_DIR="$HOME/.openclaw/queue"
PLUGIN_DIR="$HOME/.openclaw/extensions/queue-wake"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.queue-daemon.plist"

echo "🔧 Installing async-queue..."
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This duplicate finding corresponds to the same heredoc creation of the launchd plist. The risk comes from establishing automatic execution of a Node.js daemon on each login, increasing the blast radius of any later code tampering or daemon vulnerability.

Content

Scanner excerpt · scripts/install.sh (reported line 44)May include surrounding context.

sh

echo "  → Plugin installed. Reload OpenClaw (or run: openclaw gateway restart) to activate."

# ── 3. launchd plist ─────────────────────────────────────────────────────────
echo "  → Installing launchd plist: $PLIST"
cat > "$PLIST" <<PLIST_EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This duplicate finding corresponds to the same heredoc creation of the launchd plist. The risk comes from establishing automatic execution of a Node.js daemon on each login, increasing the blast radius of any later code tampering or daemon vulnerability.

Content

Scanner excerpt · scripts/install.sh (reported line 44)May include surrounding context.

sh

echo "  → Plugin installed. Reload OpenClaw (or run: openclaw gateway restart) to activate."

# ── 3. launchd plist ─────────────────────────────────────────────────────────
echo "  → Installing launchd plist: $PLIST"
cat > "$PLIST" <<PLIST_EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This line unloads any existing LaunchAgent before reloading, directly managing persistent execution state for the daemon. While expected for installer behavior, it reinforces session persistence and enables the daemon to remain active across logins without further user action.

Content

Scanner excerpt · scripts/install.sh (reported line 68)May include surrounding context.

sh

<string>${QUEUE_DIR}/daemon.log</string>
</dict>
</plist>
PLIST_EOF

launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

This line loads the LaunchAgent, immediately activating persistent execution of the queue daemon for future sessions. In the context of an agent skill, persistent background execution is more dangerous than in a simple CLI tool because it can continue processing agent tasks and any later-compromised queue data unattended.

Content

Scanner excerpt · scripts/install.sh (reported line 70)May include surrounding context.

sh

</plist>
PLIST_EOF

launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"

echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

PLIST_EOF

launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"

echo ""
echo "✅ async-queue installed and running!"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/PROTOCOL.md (reported line 87)May include surrounding context.

md

PLIST_EOF

launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"

echo ""
echo "✅ async-queue installed and running!"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 71)May include surrounding context.

sh

PLIST_EOF

launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"

echo ""
echo "✅ async-queue installed and running!"