Security audit

OpenClaw Dashboard

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local OpenClaw dashboard skill, but its bundled launchd installer creates persistent background services that are not clearly gated and point to missing, unverifiable programs.

Review carefully before installing. Run the dashboard only in foreground/manual mode unless you intentionally want persistent macOS LaunchAgents, and do not run install_launchd.sh unless the missing runtime files are present, trusted, and you are comfortable with auto-start, KeepAlive, and watchdog behavior. Be aware that stop_monitor.sh may terminate another local process if it uses port 18991.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: install_launchd.sh:5
Finding: Persistent macOS Launch Agents Execute Project-Directory Programs Across Sessions
Content: View full analysis
Vulnerability Details

File Location: install_launchd.sh, lines 5–89
Vulnerability Type: Persistent user-level startup services
Risk Level: High

Vulnerable Code

sh
LAUNCH_DIR="$HOME/Library/LaunchAgents" mkdir -p "$LAUNCH_DIR" MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF ... <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>-u</string> <string>$DIR/server.py</string> </array> <key>WorkingDirectory</key><string>$DIR</string> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> ... EOF cat > "$AUTOHEAL_PLIST" <<EOF ... <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>-u</string> <string>$DIR/autoheal.py</string> </array> <key>WorkingDirectory</key><string>$DIR</string> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> ... EOF cat > "$WATCHDOG_PLIST" <<EOF ... <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>-u</string> <string>$DIR/app_watchdog.py</string> </array> <key>WorkingDirectory</key><string>$DIR</string> <key>RunAtLoad</key><true/> <key>StartInterval</key><integer>30</integer> ... EOF launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST" launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.app-watchd ...[truncated 2464 chars]
Remediation: View remediation
Remediation Suggestions

Make launchd installation a separate, clearly documented, explicit opt-in action rather than part of a normal installation path.

Explain before execution that three cross-session services will be created, including two continuously restarted services and one 30-second scheduled task.

Do not install any service unless every referenced executable is present, integrity-checked, and included in the audited release.

Install executable files into a dedicated, versioned directory with restrictive permissions instead of executing mutable files from the source checkout.

Verify the ownership and permissions of the installation directory and scripts before registering the services.

Avoid KeepAlive unless continuous restart is operationally necessary. Configure throttling and bounded restart behavior when it is required.

Consider installing only the dashboard service by default and requiring separate consent for auto-heal and watchdog functionality.

Validate generated plist files with plutil before bootstrapping them.

If any bootstrap step fails, roll back all services and plist files created earlier in the operation.

Retain and prominently document uninstall_launchd.sh, and ensure it also verifies that all associated processes are stopped and generated runtime files are removed where appropriate.

T09 · Insecure Skill Coding Practices

Warning

Location: stop_monitor.sh:5
Finding: Port-Based Process Identification Can Terminate an Unrelated Local Service
Content: View full analysis
Vulnerability Details

File Location: stop_monitor.sh, lines 5–8
Vulnerability Type: Improper process identity validation
Risk Level: Medium

Vulnerable Code

sh
if lsof -nP -iTCP:18991 -sTCP:LISTEN >/dev/null 2>&1; then PID=$(lsof -nP -iTCP:18991 -sTCP:LISTEN -t | head -n1) kill "$PID" rm -f monitor.pid echo "Stopped monitor PID $PID" exit 0 fi

Related unsafe identification occurs in start_bg.sh, lines 7–12:

sh
if lsof -nP -iTCP:"$PORT" -sTCP:LISTEN >/dev/null 2>&1; then PID=$(lsof -nP -iTCP:"$PORT" -sTCP:LISTEN -t | head -n1) echo "$PID" > monitor.pid echo "Monitor already running on $HOST:$PORT (PID $PID)" exit 0 fi

Technical Analysis

The stop script assumes that the first process listening on TCP port 18991 is the dashboard. It does not validate the process owner, executable path, command line, start time, or relationship to a PID previously created by this project.

The background-start script reinforces the issue by treating any listener on the configured port as an existing monitor and writing that listener's PID into monitor.pid. Although the stop script does not read the PID file, both scripts present unrelated processes as project-owned processes.

Port ownership is not a reliable process-authentication mechanism. Another legitimate application may already use the port, or a local process may intentionally bind it before these scripts run. The subsequent stop operation then sends SIGTERM to that unrelated process.

Attack Path

An unrelated application or attacker-controlled local process begins listening on TCP port 18991.

The user runs start_bg.sh, which identifies that listener as the dashboard and records its PID.

The script reports that the monitor is already running even though no dashboard process was started.

The user later runs stop_monitor.sh.

The stop script again identifies the listener only by port and sends it SIGTERM.

The unrelated service is t ...[truncated 715 chars]
Remediation: View remediation
Remediation Suggestions

Use monitor.pid as the primary process reference and create it only from the PID returned when this project successfully starts its own server.

Before sending a signal, verify all of the following:

The PID exists.

The process belongs to the current user.

Its executable is the expected Python interpreter.

Its command line references the expected canonical path to server.py.

Its start time or another generated instance identifier matches the launched instance.

Refuse to terminate the process and report an ownership mismatch if any validation fails.

Treat an occupied port as a startup conflict, not proof that the dashboard is already running.

Remove stale PID files only after validating that they do not identify an active expected process.

After sending SIGTERM, wait for the validated process to exit and report failure if it remains active; use stronger signals only through a separate explicit action.

Apply the configured MONITOR_PORT consistently in both start and stop scripts rather than hardcoding port 18991 in stop_monitor.sh.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · uninstall_launchd.sh (reported line 13)May include surrounding context.
sh
launchctl bootout "gui/$UID_NOW/$MONITOR_LABEL" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/$AUTOHEAL_LABEL" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/$WATCHDOG_LABEL" >/dev/null 2>&1 || true rm -f "$LAUNCH_DIR/$MONITOR_LABEL.plist" "$LAUNCH_DIR/$AUTOHEAL_LABEL.plist" "$LAUNCH_DIR/$WATCHDOG_LABEL.plist" echo "Uninstalled launchd services."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The listing advertises "optional watchdog and auto-heal helpers" without clearly disclosing that these features may monitor, restart, or otherwise modify local processes automatically. In a local operations dashboard, understated recovery automation can mislead users about the level of control being delegated, increasing the risk of unexpected process restarts, state disruption, or unsafe operator trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The README advertises operational controls and automated recovery features that could change agent behavior or trigger actions, but it does not warn users about possible side effects, confirmation expectations, or the need to review configuration before enabling them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes three LaunchAgents into the user's LaunchAgents directory and immediately bootstraps, enables, and starts them without any user-facing confirmation, opt-in prompt, or dry-run mode. This creates persistence in the current user session and can surprise users by installing always-on background processes, which is security-relevant because persistence mechanisms are commonly abused and make later compromise harder to detect or remove.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Defining plist paths under ~/Library/LaunchAgents is part of setting up user-level launchd persistence. While variable declarations alone are not harmful, here they directly support writing persistent autorun entries for background Python services.
Content: Scanner excerpt · install_launchd.sh (reported line 9)May include surrounding context.
sh
LAUNCH_DIR="$HOME/Library/LaunchAgents" mkdir -p "$LAUNCH_DIR" MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Defining plist paths under ~/Library/LaunchAgents is part of setting up user-level launchd persistence. While variable declarations alone are not harmful, here they directly support writing persistent autorun entries for background Python services.
Content: Scanner excerpt · install_launchd.sh (reported line 9)May include surrounding context.
sh
LAUNCH_DIR="$HOME/Library/LaunchAgents" mkdir -p "$LAUNCH_DIR" MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: This defines a second LaunchAgent plist path used to persist the autoheal service. In context, it contributes to a multi-agent persistence setup that will later be installed and enabled automatically.
Content: Scanner excerpt · install_launchd.sh (reported line 10)May include surrounding context.
sh
mkdir -p "$LAUNCH_DIR" MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: This defines a second LaunchAgent plist path used to persist the autoheal service. In context, it contributes to a multi-agent persistence setup that will later be installed and enabled automatically.
Content: Scanner excerpt · install_launchd.sh (reported line 10)May include surrounding context.
sh
mkdir -p "$LAUNCH_DIR" MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: This defines a third LaunchAgent plist path for the watchdog service, contributing to persistent autorun behavior. In combination with the other agents, it increases the persistence footprint of the skill beyond a simple local dashboard launcher.
Content: Scanner excerpt · install_launchd.sh (reported line 11)May include surrounding context.
sh
MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: This defines a third LaunchAgent plist path for the watchdog service, contributing to persistent autorun behavior. In combination with the other agents, it increases the persistence footprint of the skill beyond a simple local dashboard launcher.
Content: Scanner excerpt · install_launchd.sh (reported line 11)May include surrounding context.
sh
MONITOR_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-monitor.plist" AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 13)May include surrounding context.
sh
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 15)May include surrounding context.
sh
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 34)May include surrounding context.
sh
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 36)May include surrounding context.
sh
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 55)May include surrounding context.
sh
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 57)May include surrounding context.
sh
AUTOHEAL_PLIST="$LAUNCH_DIR/com.studywest.openclaw.arcade-autoheal.plist" WATCHDOG_PLIST="$LAUNCH_DIR/com.studywest.openclaw.app-watchdog.plist" cat > "$MONITOR_PLIST" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 92% confidence
Finding: Bootstrapping the monitor plist loads the LaunchAgent into launchd, which is an active step toward persistence and background execution. In this skill context, that may be intended operationally, but silently loading it still creates a real persistence risk for the user account.
Content: Scanner excerpt · install_launchd.sh (reported line 81)May include surrounding context.
sh
launchctl bootout "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" >/dev/null 2>&1 || true launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST" launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 92% confidence
Finding: This bootstraps the autoheal LaunchAgent, immediately loading a resilience-oriented background service. Such services can make software harder to stop and can conceal problems if they continuously relaunch components.
Content: Scanner excerpt · install_launchd.sh (reported line 82)May include surrounding context.
sh
launchctl bootout "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" >/dev/null 2>&1 || true launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST" launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 92% confidence
Finding: This bootstraps the watchdog LaunchAgent, loading another background task into the user's launchd session. Combined with the other agents, it creates layered persistence that is more dangerous than a one-shot local dashboard launch.
Content: Scanner excerpt · install_launchd.sh (reported line 83)May include surrounding context.
sh
launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST" launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: This line explicitly enables a launchd agent for automatic startup in the user's GUI session, establishing persistence. In the context of a local dashboard skill, persistence may be functional, but enabling it silently still creates a security and trust risk because the service will continue running beyond the immediate invocation.
Content: Scanner excerpt · install_launchd.sh (reported line 84)May include surrounding context.
sh
launchctl bootstrap "gui/$UID_NOW" "$MONITOR_PLIST" launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: This line enables the autoheal LaunchAgent, causing it to restart automatically across user sessions. A self-healing background process is especially sensitive because it can interfere with user attempts to stop the software and can mask malfunction or compromise.
Content: Scanner excerpt · install_launchd.sh (reported line 85)May include surrounding context.
sh
launchctl bootstrap "gui/$UID_NOW" "$AUTOHEAL_PLIST" launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: This enables the watchdog LaunchAgent, establishing another persistent background mechanism. Multiple persistent agents increase the attack surface and operational opacity, especially when one process monitors or relaunches others.
Content: Scanner excerpt · install_launchd.sh (reported line 86)May include surrounding context.
sh
launchctl bootstrap "gui/$UID_NOW" "$WATCHDOG_PLIST" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl enable "gui/$UID_NOW/com.studywest.openclaw.app-watchdog" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-monitor" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.arcade-autoheal" launchctl kickstart -k "gui/$UID_NOW/com.studywest.openclaw.app-watchdog"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · start_bg.sh (reported line 15)May include surrounding context.
sh
exit 0 fi MONITOR_HOST="$HOST" MONITOR_PORT="$PORT" /usr/bin/nohup /usr/bin/python3 -u server.py </dev/null >monitor.log 2>&1 & PID="" for _ in {1..10}; do sleep 1

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 15)May include surrounding context.
sh
launchctl bootout "gui/$UID_NOW/$MONITOR_LABEL" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/$AUTOHEAL_LABEL" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/$WATCHDOG_LABEL" >/dev/null 2>&1 || true rm -f "$LAUNCH_DIR/$MONITOR_LABEL.plist" "$LAUNCH_DIR/$AUTOHEAL_LABEL.plist" "$LAUNCH_DIR/$WATCHDOG_LABEL.plist" echo "Uninstalled launchd services."

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install_launchd.sh (reported line 16)May include surrounding context.
sh
launchctl bootout "gui/$UID_NOW/$MONITOR_LABEL" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/$AUTOHEAL_LABEL" >/dev/null 2>&1 || true launchctl bootout "gui/$UID_NOW/$WATCHDOG_LABEL" >/dev/null 2>&1 || true rm -f "$LAUNCH_DIR/$MONITOR_LABEL.plist" "$LAUNCH_DIR/$AUTOHEAL_LABEL.plist" "$LAUNCH_DIR/$WATCHDOG_LABEL.plist" echo "Uninstalled launchd services."

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Static analysis