Openclaw Keepalive

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with keeping an OpenClaw gateway online, but it asks users to make persistent host-wide power and startup changes with too little scoping or rollback guidance.

Install only if you intentionally want this machine to act as an always-on OpenClaw gateway. Prefer the built-in OpenClaw service command first, avoid highest-privilege startup tasks unless required, use absolute executable paths, and do not disable sleep or hibernation on shared, managed, or battery-powered machines without knowing how to restore the original settings.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:144
• Finding: Privileged Boot Persistence Through Windows Task Scheduler## Vulnerability Details **File Location**: `SKILL.md`, lines 144–152 **Vulnerability Type**: Privileged scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```powershell ### Option C: Windows Task Scheduler (Manual) ```powershell # Create auto-start task with 1-minute restart on failure schtasks /create /tn "OpenClaw Gateway" /tr "openclaw gateway start" /sc onstart /rl highest /f # Or use Task Scheduler GUI for finer restart policies ``` ``` ### Technical Analysis The command creates a scheduled task that survives reboots and executes whenever Windows starts. Persistence is consistent with the Skill's stated keepalive purpose, but `/rl highest` requests the highest available execution level without demonstrating that the gateway requires administrative privileges. The task action also invokes `openclaw` by name instead of using an absolute, verified executable path. Its eventual resolution can depend on the task environment and executable search configuration. If an attacker who already has local write access can replace the expected executable or influence how it is resolved, the persistent task could execute attacker-controlled code at an elevated level. This behavior therefore combines an intentional persistence mechanism with an avoidable privilege-boundary risk. ### Attack Path 1. A user follows the Skill and authorizes creation of the scheduled task. 2. Windows registers `OpenClaw Gateway` to execute at system startup with the highest available run level. 3. An attacker with sufficient local write access replaces the expected `openclaw` executable or causes the unqualified command to resolve to an attacker-controlled executable. 4. The computer starts or the task is otherwise triggered. 5. The attacker-controlled executable runs through the persistent task at its elevated execution level. ### Impact Assessment The task provides cross-reboot execution and may provide administrative ...[truncated 284 chars]
• Remediation: ## Remediation Suggestions - Remove `/rl highest` unless a documented gateway operation strictly requires elevation. - Run the gateway under a dedicated, unprivileged service account with no interactive logon rights. - Use an absolute path to the verified `openclaw` executable rather than relying on command-name resolution. - Restrict write permissions on the executable, installation directory, task definition, and configuration files. - Prefer per-user startup registration when the gateway only serves the current user. - Display the exact task definition and privilege level before requesting user approval. - Provide and verify an explicit removal command, such as deleting the named scheduled task. - Configure bounded restart behavior to avoid uncontrolled restart loops.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:68
• Finding: Host-Wide Power Protections Disabled With Administrative Privileges## Vulnerability Details **File Location**: `SKILL.md`, lines 68–87 **Vulnerability Type**: Excessive privileged system configuration **Risk Level**: Medium ### Vulnerable Code ```bash ### macOS ```bash # Prevent system sleep sudo pmset -a sleep 0 # Prevent disk sleep sudo pmset -a disksleep 0 # Allow display off but keep system running sudo pmset -a displaysleep 10 ``` ### Linux ```bash # Disable suspend sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target ``` ``` ### Technical Analysis These commands use administrative privileges to alter host-wide power policy. On macOS, `pmset -a` applies settings across all power sources. On Linux, masking the listed systemd targets prevents normal suspend and hibernation mechanisms system-wide. Keeping a gateway active can justify inhibiting sleep while the process is needed, but permanently disabling sleep, hibernation, and hybrid sleep exceeds the minimum scope necessary. The instructions provide no automatic restoration, rollback procedure, time limit, or confirmation that the machine is dedicated to continuous service. This is an excessive-privilege configuration issue rather than covert privilege escalation: the user invokes `sudo` visibly, but the resulting administrative changes affect the entire host and all users. ### Attack Path 1. A user follows the Skill's “Prevent Sleep” instructions and grants administrator authorization. 2. Global sleep settings are disabled or systemd sleep-related targets are masked. 3. The configuration persists after the gateway is stopped and across subsequent sessions. 4. The workstation remains active when users would ordinarily expect suspend or hibernation protections. 5. Physical-access exposure, unattended network availability, energy consumption, and thermal load remain increased until an administrator manually restores the settings. ### Impact Assessment The commands modi ...[truncated 321 chars]
• Remediation: ## Remediation Suggestions - Prefer process-scoped, temporary sleep inhibitors rather than permanent host-wide changes. - On Linux, use a narrowly scoped mechanism such as `systemd-inhibit` while the gateway is active. - On macOS, use a process-lifetime mechanism such as `caffeinate` instead of changing all power profiles permanently. - Preserve the user's existing configuration before making changes and restore it automatically when the gateway stops. - Provide exact rollback instructions, including unmasking all affected systemd targets and restoring prior `pmset` values. - Require explicit confirmation and explain the security and operational consequences before any administrator command is run. - Limit permanent power-policy changes to dedicated servers whose owners have explicitly selected that operating model.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:126
• Finding: Unpinned Global PM2 Installation Adds Supply-Chain and Persistence Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 126–135 **Vulnerability Type**: Unpinned global third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash ### Option A: pm2 (Recommended, Cross-Platform) ```bash npm install -g pm2 pm2 start openclaw -- gateway start pm2 save pm2 startup # Generate startup command ``` ``` ### Technical Analysis `npm install -g pm2` retrieves the currently resolved package version from the configured npm registry and installs it globally. The instructions do not pin an audited version, verify package integrity or provenance, inspect lifecycle behavior, or constrain the installation to the project. A global npm installation has broader reach than a local dependency and may execute package lifecycle scripts under the privileges used for installation. The subsequent `pm2 startup` operation generates another startup integration, while `pm2 save` preserves the configured process list. PM2 is not shown to be malicious in the audited file. The vulnerability is the mutable, unverified dependency acquisition process and the additional persistence surface it introduces. ### Attack Path 1. A user executes the unpinned global installation command. 2. npm resolves the package and transitive dependencies available from the user's configured registry at installation time. 3. If the registry, account, package release, dependency chain, or local npm configuration has been compromised, attacker-controlled package code may be installed and lifecycle code may execute. 4. The user runs `pm2 save` and `pm2 startup`. 5. The compromised process manager or configured process can be registered for recurring startup execution. ### Impact Assessment Exploitation could execute code with the privileges used for the global npm installation and could preserve execution through PM2's startup configuration. The affected scope may include global Node.js tooling, the user accoun ...[truncated 114 chars]
• Remediation: ## Remediation Suggestions - Prefer OpenClaw's built-in service mechanism rather than introducing an additional process supervisor. - If PM2 is required, pin a reviewed exact version instead of installing the mutable latest release. - Verify package provenance, registry configuration, integrity metadata, maintainers, and audit results before installation. - Avoid global installation where possible; use a project-scoped dependency with a lockfile and integrity records. - Do not run npm installation commands as an administrator unless strictly necessary. - Review the complete command generated by `pm2 startup` before executing it. - Run PM2 and the gateway under a dedicated unprivileged account. - Document removal of the PM2 startup integration and stored process configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent

Content

- Survives screen lock and user session disconnect

### macOS
- Registers via **launchd** plist
- Supports `KeepAlive=true` for auto-restart

### Linux

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill provides system-wide sleep-prevention and suspend-disabling commands for Windows, macOS, and Linux without an explicit warning that they change host power behavior, may require elevated privileges, and can affect battery life, thermal load, and device security posture. Because these commands are presented as routine setup steps, a user may apply persistent OS-level changes without understanding the operational impact or how to revert them.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### macOS
```bash
# Prevent system sleep
sudo pmset -a sleep 0

# Prevent disk sleep
sudo pmset -a disksleep 0

• Confidence: 88% confidence
• Finding: This instruction tells the user to run `sudo pmset -a sleep 0`, which requires elevated privileges and disables system sleep globally across power profiles. While not inherently malicious, embedding a root-level command without a clear privilege warning, scope explanation, or rollback increases the risk of unnecessary privileged changes on a non-dedicated workstation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo pmset -a sleep 0

# Prevent disk sleep
sudo pmset -a disksleep 0

# Allow display off but keep system running
sudo pmset -a displaysleep 10

• Confidence: 86% confidence
• Finding: The `sudo pmset -a disksleep 0` command requires elevated privileges and persistently disables disk sleep, affecting system power usage and hardware behavior. In a keepalive skill, this may be functionally relevant, but presenting it without impact warnings or justification encourages broad privileged modification beyond the minimum needed to keep the gateway online.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo pmset -a disksleep 0

# Allow display off but keep system running
sudo pmset -a displaysleep 10
```

### Linux

• Confidence: 84% confidence
• Finding: The `sudo pmset -a displaysleep 10` instruction is a privileged system-wide configuration change. Its direct security impact is lower than disabling system sleep, but it still normalizes root execution and modifies host behavior without warning, which is risky in operational documentation intended for broad use.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Linux
```bash
# Disable suspend
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
```

## Network Recovery

• Confidence: 94% confidence
• Finding: The Linux command `sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target` requires root and permanently disables multiple power-management targets at the OS level until reversed. This is a strong host-wide change that can conflict with enterprise power policies, increase operational exposure, and be difficult for non-expert users to unwind if no warning or rollback is given.

Static analysis

No suspicious patterns detected.