Openclaw Keepalive

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with keeping an OpenClaw gateway online, but it asks users to make persistent host-wide power and startup changes with too little scoping or rollback guidance.

Install only if you intentionally want this machine to act as an always-on OpenClaw gateway. Prefer the built-in OpenClaw service command first, avoid highest-privilege startup tasks unless required, use absolute executable paths, and do not disable sleep or hibernation on shared, managed, or battery-powered machines without knowing how to restore the original settings.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:144

Finding

Privileged Boot Persistence Through Windows Task Scheduler

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 144–152
Vulnerability Type: Privileged scheduled-task persistence
Risk Level: High

Vulnerable Code

powershell

### Option C: Windows Task Scheduler (Manual)
```powershell
# Create auto-start task with 1-minute restart on failure
schtasks /create /tn "OpenClaw Gateway" /tr "openclaw gateway start" /sc onstart /rl highest /f

# Or use Task Scheduler GUI for finer restart policies

text

### Technical Analysis

The command creates a scheduled task that survives reboots and executes whenever Windows starts. Persistence is consistent with the Skill's stated keepalive purpose, but `/rl highest` requests the highest available execution level without demonstrating that the gateway requires administrative privileges.

The task action also invokes `openclaw` by name instead of using an absolute, verified executable path. Its eventual resolution can depend on the task environment and executable search configuration. If an attacker who already has local write access can replace the expected executable or influence how it is resolved, the persistent task could execute attacker-controlled code at an elevated level.

This behavior therefore combines an intentional persistence mechanism with an avoidable privilege-boundary risk.

### Attack Path

1. A user follows the Skill and authorizes creation of the scheduled task.
2. Windows registers `OpenClaw Gateway` to execute at system startup with the highest available run level.
3. An attacker with sufficient local write access replaces the expected `openclaw` executable or causes the unqualified command to resolve to an attacker-controlled executable.
4. The computer starts or the task is otherwise triggered.
5. The attacker-controlled executable runs through the persistent task at its elevated execution level.

### Impact Assessment

The task provides cross-reboot execution and may provide administrative
...[truncated 284 chars]

Remediation

View remediation

Remediation Suggestions

• Remove /rl highest unless a documented gateway operation strictly requires elevation.
• Run the gateway under a dedicated, unprivileged service account with no interactive logon rights.
• Use an absolute path to the verified openclaw executable rather than relying on command-name resolution.
• Restrict write permissions on the executable, installation directory, task definition, and configuration files.
• Prefer per-user startup registration when the gateway only serves the current user.
• Display the exact task definition and privilege level before requesting user approval.
• Provide and verify an explicit removal command, such as deleting the named scheduled task.
• Configure bounded restart behavior to avoid uncontrolled restart loops.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:68

Finding

Host-Wide Power Protections Disabled With Administrative Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68–87
Vulnerability Type: Excessive privileged system configuration
Risk Level: Medium

Vulnerable Code

bash

### macOS
```bash
# Prevent system sleep
sudo pmset -a sleep 0

# Prevent disk sleep
sudo pmset -a disksleep 0

# Allow display off but keep system running
sudo pmset -a displaysleep 10

Linux

bash

# Disable suspend
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

text

### Technical Analysis

These commands use administrative privileges to alter host-wide power policy. On macOS, `pmset -a` applies settings across all power sources. On Linux, masking the listed systemd targets prevents normal suspend and hibernation mechanisms system-wide.

Keeping a gateway active can justify inhibiting sleep while the process is needed, but permanently disabling sleep, hibernation, and hybrid sleep exceeds the minimum scope necessary. The instructions provide no automatic restoration, rollback procedure, time limit, or confirmation that the machine is dedicated to continuous service.

This is an excessive-privilege configuration issue rather than covert privilege escalation: the user invokes `sudo` visibly, but the resulting administrative changes affect the entire host and all users.

### Attack Path

1. A user follows the Skill's “Prevent Sleep” instructions and grants administrator authorization.
2. Global sleep settings are disabled or systemd sleep-related targets are masked.
3. The configuration persists after the gateway is stopped and across subsequent sessions.
4. The workstation remains active when users would ordinarily expect suspend or hibernation protections.
5. Physical-access exposure, unattended network availability, energy consumption, and thermal load remain increased until an administrator manually restores the settings.

### Impact Assessment

The commands modi
...[truncated 321 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer process-scoped, temporary sleep inhibitors rather than permanent host-wide changes.
• On Linux, use a narrowly scoped mechanism such as systemd-inhibit while the gateway is active.
• On macOS, use a process-lifetime mechanism such as caffeinate instead of changing all power profiles permanently.
• Preserve the user's existing configuration before making changes and restore it automatically when the gateway stops.
• Provide exact rollback instructions, including unmasking all affected systemd targets and restoring prior pmset values.
• Require explicit confirmation and explain the security and operational consequences before any administrator command is run.
• Limit permanent power-policy changes to dedicated servers whose owners have explicitly selected that operating model.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:126

Finding

Unpinned Global PM2 Installation Adds Supply-Chain and Persistence Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126–135
Vulnerability Type: Unpinned global third-party dependency
Risk Level: Medium

Vulnerable Code

bash

### Option A: pm2 (Recommended, Cross-Platform)
```bash
npm install -g pm2
pm2 start openclaw -- gateway start
pm2 save
pm2 startup  # Generate startup command

text

### Technical Analysis

`npm install -g pm2` retrieves the currently resolved package version from the configured npm registry and installs it globally. The instructions do not pin an audited version, verify package integrity or provenance, inspect lifecycle behavior, or constrain the installation to the project.

A global npm installation has broader reach than a local dependency and may execute package lifecycle scripts under the privileges used for installation. The subsequent `pm2 startup` operation generates another startup integration, while `pm2 save` preserves the configured process list.

PM2 is not shown to be malicious in the audited file. The vulnerability is the mutable, unverified dependency acquisition process and the additional persistence surface it introduces.

### Attack Path

1. A user executes the unpinned global installation command.
2. npm resolves the package and transitive dependencies available from the user's configured registry at installation time.
3. If the registry, account, package release, dependency chain, or local npm configuration has been compromised, attacker-controlled package code may be installed and lifecycle code may execute.
4. The user runs `pm2 save` and `pm2 startup`.
5. The compromised process manager or configured process can be registered for recurring startup execution.

### Impact Assessment

Exploitation could execute code with the privileges used for the global npm installation and could preserve execution through PM2's startup configuration. The affected scope may include global Node.js tooling, the user accoun
...[truncated 114 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer OpenClaw's built-in service mechanism rather than introducing an additional process supervisor.
• If PM2 is required, pin a reviewed exact version instead of installing the mutable latest release.
• Verify package provenance, registry configuration, integrity metadata, maintainers, and audit results before installation.
• Avoid global installation where possible; use a project-scoped dependency with a lockfile and integrity records.
• Do not run npm installation commands as an administrator unless strictly necessary.
• Review the complete command generated by pm2 startup before executing it.
• Run PM2 and the gateway under a dedicated unprivileged account.
• Document removal of the PM2 startup integration and stored process configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- Survives screen lock and user session disconnect

### macOS
- Registers via **launchd** plist
- Supports `KeepAlive=true` for auto-restart

### Linux

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill provides system-wide sleep-prevention and suspend-disabling commands for Windows, macOS, and Linux without an explicit warning that they change host power behavior, may require elevated privileges, and can affect battery life, thermal load, and device security posture. Because these commands are presented as routine setup steps, a user may apply persistent OS-level changes without understanding the operational impact or how to revert them.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This instruction tells the user to run sudo pmset -a sleep 0, which requires elevated privileges and disables system sleep globally across power profiles. While not inherently malicious, embedding a root-level command without a clear privilege warning, scope explanation, or rollback increases the risk of unnecessary privileged changes on a non-dedicated workstation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

macOS

bash

# Prevent system sleep
sudo pmset -a sleep 0

# Prevent disk sleep
sudo pmset -a disksleep 0

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The sudo pmset -a disksleep 0 command requires elevated privileges and persistently disables disk sleep, affecting system power usage and hardware behavior. In a keepalive skill, this may be functionally relevant, but presenting it without impact warnings or justification encourages broad privileged modification beyond the minimum needed to keep the gateway online.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

sudo pmset -a sleep 0

# Prevent disk sleep
sudo pmset -a disksleep 0

# Allow display off but keep system running
sudo pmset -a displaysleep 10

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The sudo pmset -a displaysleep 10 instruction is a privileged system-wide configuration change. Its direct security impact is lower than disabling system sleep, but it still normalizes root execution and modifies host behavior without warning, which is risky in operational documentation intended for broad use.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

sudo pmset -a disksleep 0

Allow display off but keep system running

sudo pmset -a displaysleep 10

text

### Linux

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The Linux command sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target requires root and permanently disables multiple power-management targets at the OS level until reversed. This is a strong host-wide change that can conflict with enterprise power policies, increase operational exposure, and be difficult for non-expert users to unwind if no warning or rollback is given.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Linux

bash

# Disable suspend
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

Network Recovery

Static analysis

No suspicious patterns detected.