ClawHub
Back to skill

Security audit

Openclaw Guardian

Security checks for vulnerabilities and agentic risk

Overview

This watchdog skill is mostly purpose-aligned, but it asks users to install persistent unattended repair behavior that can reset Git state and restart processes without enough scoping or warning.

Review carefully before installing. Only enable this on an OpenClaw instance where unattended repair and rollback are acceptable, inspect the actual guardian.sh script first, back up or commit important workspace changes, avoid enabling git reset --hard without explicit control, and treat Discord alerts as third-party data sharing.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Error
Location
SKILL.md:45
Finding

Persistent Watchdog Installation Through Gateway Startup Script

Content
View full analysis
/dev/null || true nohup /home/ubuntu/.openclaw/guardian.sh >> /tmp/openclaw-guardian.log 2>&1 & ``` ``` ### Technical Analysis The skill instructs the user or agent to modify `~/.openclaw/start-gateway.sh` so that `guardian.sh` is launched whenever the container or gateway startup sequence runs. This establishes cross-session persistence beyond the skill's initial execution. The launched watchdog is intended to perform unattended repair and rollback operations. However, the referenced `scripts/guardian.sh` is absent from the audited project, so its implementation and the exact commands executed after persistence is established cannot be verified. The command `pkill -f "guardian.sh"` performs substring matching against complete process command lines. It is not restricted to a verified PID, executable path, or process owner. It can therefore terminate unrelated processes whose command lines happen to contain `guardian.sh`. ### Attack Path 1. A user or agent loads the skill and follows its setup instructions. 2. A file is installed as `~/.openclaw/guardian.sh` and made executable. 3. The supplied commands are inserted into `~/.openclaw/start-gateway.sh`. 4. On each subsequent container or gateway startup, `pkill -f` terminates matching processes. 5. The startup script launches `/home/ubuntu/.openclaw/guardian.sh` in the background with `nohup`. 6. The watchdog continues running independently of the original skill session and is relaunched after later restarts. 7. Any commands present in the installed watchdog execute with the same privileges as the account running the startup script. ### Impact Assessment The ...[truncated 688 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

git reset --hard is a destructive command that irreversibly discards uncommitted workspace changes, and here it is embedded in an automated repair path triggered by service health checks. In the context of a watchdog, transient failures, misdiagnosis, or deliberate triggering could cause repeated rollback of legitimate work or configuration, making the action materially dangerous beyond ordinary administration.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
**Repair ladder:**
1. Detect Gateway down (every 30s)
2. Run `openclaw doctor --fix` (up to 3 attempts)
3. If still down → `git reset --hard` to last stable commit, restart Gateway
4. If all fails → cooldown 300s, resume monitoring
5. Daily automatic git snapshot of workspace

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly automates potentially destructive recovery actions, including doctor --fix and git reset --hard, but does not clearly warn that local changes may be discarded or configuration/workspace state may be rolled back. In an operational recovery skill, that omission can cause unintended data loss because users may enable the watchdog without understanding that repair actions are not purely read-only or reversible.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Container / no systemd (nohup):

bash
nohup ~/.openclaw/guardian.sh >> /tmp/openclaw-guardian.log 2>&1 &

Linux VPS with systemd: See references/setup.md → Pattern B.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Container / no systemd (nohup):

bash
nohup ~/.openclaw/guardian.sh >> /tmp/openclaw-guardian.log 2>&1 &

Linux VPS with systemd: See references/setup.md → Pattern B.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents Discord webhook alerting but does not warn that operational metadata, errors, host details, or other monitoring content may be transmitted to a third-party service. This creates a privacy and data handling risk, especially in production environments where logs or alerts may contain sensitive environment information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.