OpenClaw Dashboard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:55 PM UTC
• Version: 1.0.2

Overview

This appears to be a local OpenClaw dashboard skill, but its bundled launchd installer creates persistent background services that are not clearly gated and point to missing, unverifiable programs.

Review carefully before installing. Run the dashboard only in foreground/manual mode unless you intentionally want persistent macOS LaunchAgents, and do not run install_launchd.sh unless the missing runtime files are present, trusted, and you are comfortable with auto-start, KeepAlive, and watchdog behavior. Be aware that stop_monitor.sh may terminate another local process if it uses port 18991.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: install_launchd.sh:5
• Finding: Persistent macOS Launch Agents Execute Project-Directory Programs Across Sessions## Vulnerability Details **File Location**: `install_launchd.sh`, lines 5–89 **Vulnerability Type**: Persistent user-level startup services **Risk Level**: High ### Vulnerable Code ```sh LAUNCH_DIR="$HOME/Library/LaunchAgents" mkdir -p "$LAUNCH_DIR" MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF ... <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>-u</string> <string>$DIR/server.py</string> </array> <key>WorkingDirectory</key><string>$DIR</string> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> ... EOF cat > "$AUTOHEAL_PLIST" <<EOF ... <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>-u</string> <string>$DIR/autoheal.py</string> </array> <key>WorkingDirectory</key><string>$DIR</string> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> ... EOF cat > "$WATCHDOG_PLIST" <<EOF ... <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>-u</string> <string>$DIR/app_watchdog.py</string> </array> <key>WorkingDirectory</key><string>$DIR</string> <key>RunAtLoad</key><true/> <key>StartInterval</key><integer>30</integer> ... EOF launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST" launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.app-watchd ...[truncated 2464 chars]
• Remediation: ## Remediation Suggestions 1. Make launchd installation a separate, clearly documented, explicit opt-in action rather than part of a normal installation path. 2. Explain before execution that three cross-session services will be created, including two continuously restarted services and one 30-second scheduled task. 3. Do not install any service unless every referenced executable is present, integrity-checked, and included in the audited release. 4. Install executable files into a dedicated, versioned directory with restrictive permissions instead of executing mutable files from the source checkout. 5. Verify the ownership and permissions of the installation directory and scripts before registering the services. 6. Avoid `KeepAlive` unless continuous restart is operationally necessary. Configure throttling and bounded restart behavior when it is required. 7. Consider installing only the dashboard service by default and requiring separate consent for auto-heal and watchdog functionality. 8. Validate generated plist files with `plutil` before bootstrapping them. 9. If any bootstrap step fails, roll back all services and plist files created earlier in the operation. 10. Retain and prominently document `uninstall_launchd.sh`, and ensure it also verifies that all associated processes are stopped and generated runtime files are removed where appropriate.

T09 · Insecure Skill Coding Practices

Warning

• Location: stop_monitor.sh:5
• Finding: Port-Based Process Identification Can Terminate an Unrelated Local Service## Vulnerability Details **File Location**: `stop_monitor.sh`, lines 5–8 **Vulnerability Type**: Improper process identity validation **Risk Level**: Medium ### Vulnerable Code ```sh if lsof -nP -iTCP:18991 -sTCP:LISTEN >/dev/null 2>&1; then PID=$(lsof -nP -iTCP:18991 -sTCP:LISTEN -t | head -n1) kill "$PID" rm -f monitor.pid echo "Stopped monitor PID $PID" exit 0 fi ``` Related unsafe identification occurs in `start_bg.sh`, lines 7–12: ```sh if lsof -nP -iTCP:"$PORT" -sTCP:LISTEN >/dev/null 2>&1; then PID=$(lsof -nP -iTCP:"$PORT" -sTCP:LISTEN -t | head -n1) echo "$PID" > monitor.pid echo "Monitor already running on $HOST:$PORT (PID $PID)" exit 0 fi ``` ### Technical Analysis The stop script assumes that the first process listening on TCP port 18991 is the dashboard. It does not validate the process owner, executable path, command line, start time, or relationship to a PID previously created by this project. The background-start script reinforces the issue by treating any listener on the configured port as an existing monitor and writing that listener's PID into `monitor.pid`. Although the stop script does not read the PID file, both scripts present unrelated processes as project-owned processes. Port ownership is not a reliable process-authentication mechanism. Another legitimate application may already use the port, or a local process may intentionally bind it before these scripts run. The subsequent stop operation then sends `SIGTERM` to that unrelated process. ### Attack Path 1. An unrelated application or attacker-controlled local process begins listening on TCP port 18991. 2. The user runs `start_bg.sh`, which identifies that listener as the dashboard and records its PID. 3. The script reports that the monitor is already running even though no dashboard process was started. 4. The user later runs `stop_monitor.sh`. 5. The stop script again identifies the listener only by port and sends it `SIGTERM`. 6. The unrelated service is t ...[truncated 715 chars]
• Remediation: ## Remediation Suggestions 1. Use `monitor.pid` as the primary process reference and create it only from the PID returned when this project successfully starts its own server. 2. Before sending a signal, verify all of the following: - The PID exists. - The process belongs to the current user. - Its executable is the expected Python interpreter. - Its command line references the expected canonical path to `server.py`. - Its start time or another generated instance identifier matches the launched instance. 3. Refuse to terminate the process and report an ownership mismatch if any validation fails. 4. Treat an occupied port as a startup conflict, not proof that the dashboard is already running. 5. Remove stale PID files only after validating that they do not identify an active expected process. 6. After sending `SIGTERM`, wait for the validated process to exit and report failure if it remains active; use stronger signals only through a separate explicit action. 7. Apply the configured `MONITOR_PORT` consistently in both start and stop scripts rather than hardcoding port 18991 in `stop_monitor.sh`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

launchctl bootout "gui/$UID_NOW/$MONITOR_LABEL" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/$AUTOHEAL_LABEL" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/$WATCHDOG_LABEL" >/dev/null 2>&1 || true
rm -f "$LAUNCH_DIR/$MONITOR_LABEL.plist" "$LAUNCH_DIR/$AUTOHEAL_LABEL.plist" "$LAUNCH_DIR/$WATCHDOG_LABEL.plist"

echo "Uninstalled launchd services."

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The listing advertises "optional watchdog and auto-heal helpers" without clearly disclosing that these features may monitor, restart, or otherwise modify local processes automatically. In a local operations dashboard, understated recovery automation can mislead users about the level of control being delegated, increasing the risk of unexpected process restarts, state disruption, or unsafe operator trust.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The README advertises operational controls and automated recovery features that could change agent behavior or trigger actions, but it does not warn users about possible side effects, confirmation expectations, or the need to review configuration before enabling them.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes three LaunchAgents into the user's LaunchAgents directory and immediately bootstraps, enables, and starts them without any user-facing confirmation, opt-in prompt, or dry-run mode. This creates persistence in the current user session and can surprise users by installing always-on background processes, which is security-relevant because persistence mechanisms are commonly abused and make later compromise harder to detect or remove.

Session Persistence

Medium

• Category: Rogue Agent

Content

LAUNCH_DIR="$HOME/Library/LaunchAgents"
mkdir -p "$LAUNCH_DIR"

MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist"
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

• Confidence: 80% confidence
• Finding: Defining plist paths under ~/Library/LaunchAgents is part of setting up user-level launchd persistence. While variable declarations alone are not harmful, here they directly support writing persistent autorun entries for background Python services.

Session Persistence

Medium

• Category: Rogue Agent

Content

LAUNCH_DIR="$HOME/Library/LaunchAgents"
mkdir -p "$LAUNCH_DIR"

MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist"
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

• Confidence: 80% confidence
• Finding: Defining plist paths under ~/Library/LaunchAgents is part of setting up user-level launchd persistence. While variable declarations alone are not harmful, here they directly support writing persistent autorun entries for background Python services.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$LAUNCH_DIR"

MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist"
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF

• Confidence: 80% confidence
• Finding: This defines a second LaunchAgent plist path used to persist the autoheal service. In context, it contributes to a multi-agent persistence setup that will later be installed and enabled automatically.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$LAUNCH_DIR"

MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist"
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF

• Confidence: 80% confidence
• Finding: This defines a second LaunchAgent plist path used to persist the autoheal service. In context, it contributes to a multi-agent persistence setup that will later be installed and enabled automatically.

Session Persistence

Medium

• Category: Rogue Agent

Content

MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist"
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 80% confidence
• Finding: This defines a third LaunchAgent plist path for the watchdog service, contributing to persistent autorun behavior. In combination with the other agents, it increases the persistence footprint of the skill beyond a simple local dashboard launcher.

Session Persistence

Medium

• Category: Rogue Agent

Content

MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist"
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 80% confidence
• Finding: This defines a third LaunchAgent plist path for the watchdog service, contributing to persistent autorun behavior. In combination with the other agents, it increases the persistence footprint of the skill beyond a simple local dashboard launcher.

Session Persistence

Medium

• Category: Rogue Agent

Content

AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist"
WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

cat > "$MONITOR_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootout "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" >/dev/null 2>&1 || true

launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"

• Confidence: 92% confidence
• Finding: Bootstrapping the monitor plist loads the LaunchAgent into launchd, which is an active step toward persistence and background execution. In this skill context, that may be intended operationally, but silently loading it still creates a real persistence risk for the user account.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootout "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" >/dev/null 2>&1 || true

launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"

• Confidence: 92% confidence
• Finding: This bootstraps the autoheal LaunchAgent, immediately loading a resilience-oriented background service. Such services can make software harder to stop and can conceal problems if they continuously relaunch components.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"

• Confidence: 92% confidence
• Finding: This bootstraps the watchdog LaunchAgent, loading another background task into the user's launchd session. Combined with the other agents, it creates layered persistence that is more dangerous than a one-shot local dashboard launch.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"
launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"

• Confidence: 97% confidence
• Finding: This line explicitly enables a launchd agent for automatic startup in the user's GUI session, establishing persistence. In the context of a local dashboard skill, persistence may be functional, but enabling it silently still creates a security and trust risk because the service will continue running beyond the immediate invocation.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST"
launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"
launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"

• Confidence: 97% confidence
• Finding: This line enables the autoheal LaunchAgent, causing it to restart automatically across user sessions. A self-healing background process is especially sensitive because it can interfere with user attempts to stop the software and can mask malfunction or compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"
launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"
launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"
launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"
launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"

• Confidence: 97% confidence
• Finding: This enables the watchdog LaunchAgent, establishing another persistent background mechanism. Multiple persistent agents increase the attack surface and operational opacity, especially when one process monitors or relaunches others.

Session Persistence

Medium

• Category: Rogue Agent

Content

exit 0
fi

MONITOR_HOST="$HOST" MONITOR_PORT="$PORT" /usr/bin/nohup /usr/bin/python3 -u server.py </dev/null >monitor.log 2>&1 &
PID=""
for _ in {1..10}; do
  sleep 1

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootout "gui/$UID_NOW/$MONITOR_LABEL" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/$AUTOHEAL_LABEL" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/$WATCHDOG_LABEL" >/dev/null 2>&1 || true
rm -f "$LAUNCH_DIR/$MONITOR_LABEL.plist" "$LAUNCH_DIR/$AUTOHEAL_LABEL.plist" "$LAUNCH_DIR/$WATCHDOG_LABEL.plist"

echo "Uninstalled launchd services."

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl bootout "gui/$UID_NOW/$MONITOR_LABEL" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/$AUTOHEAL_LABEL" >/dev/null 2>&1 || true
launchctl bootout "gui/$UID_NOW/$WATCHDOG_LABEL" >/dev/null 2>&1 || true
rm -f "$LAUNCH_DIR/$MONITOR_LABEL.plist" "$LAUNCH_DIR/$AUTOHEAL_LABEL.plist" "$LAUNCH_DIR/$WATCHDOG_LABEL.plist"

echo "Uninstalled launchd services."

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.