Security audit

Update Advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate update-recovery purpose, but its watchdog state handling in temporary files creates a real local abuse risk.

Review this before installing, especially on shared machines. The update and recovery flow is disclosed and useful, but the watchdog should use a private owner-only state directory, atomically create state files, avoid loading executable paths from state, validate cleanup paths, and enforce timeouts around OpenClaw subprocesses before it is treated as low risk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/arm-recovery-watchdog.sh:294
Finding: Untrusted watchdog state file permits command hijacking and arbitrary file deletion
Content: View full analysis
"$state_file" write_kv "$state_file" "backend" "$backend" write_kv "$state_file" "label" "$label" write_kv "$state_file" "unit" "$unit" write_kv "$state_file" "domain" "$LAUNCHCTL_DOMAIN" write_kv "$state_file" "plist" "$plist" write_kv "$state_file" "watchdog_log" "$watchdog_log" write_kv "$state_file" "stdout_log" "$stdout_log" write_kv "$state_file" "stderr_log" "$stderr_log" write_kv "$state_file" "launchctl_bin" "$LAUNCHCTL_BIN" write_kv "$state_file" "systemctl_bin" "$SYSTEMCTL_BIN" write_kv "$state_file" "openclaw_bin" "$OPENCLAW_BIN" ``` ```bash backend="$(read_state_value "$state_file" backend)" label="$(read_state_value "$state_file" label)" unit="$(read_state_value "$state_file" unit)" domain="$(read_state_value "$state_file" domain)" plist="$(read_state_value "$state_file" plist)" watchdog_log="$(read_state_value "$state_file" watchdog_log)" stdout_log="$(read_state_value "$state_file" stdout_log)" stderr_log="$(read_state_value "$state_file" stderr_log)" stored_launchctl="$(read_state_value "$state_file" launchctl_bin)" stored_systemctl="$(read_state_value "$state_file" systemctl_bin)" [[ -n "$stored_launchctl" ]] && L ...[truncated 3105 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/recovery-watchdog.sh:93
Finding: Watchdog runtime limit does not bound hanging OpenClaw child commands
Content: View full analysis
&1)" rc=$? set -e printf '%s\n' "$out" return "$rc" } run_gateway_install() { local out rc set +e out="$("$OPENCLAW_BIN" gateway install 2>&1)" rc=$? set -e log "recovery_command_rc=$rc output=$(printf '%s' "$out" | tr '\n' ' ' | sed 's/[[:space:]]\+/ /g')" return "$rc" } ``` ```bash for (( attempt=1; attempt<=RECOVERY_RETRIES; attempt++ )); do enforce_deadline "before_recovery_attempt_$attempt" log "recovery_attempt=$attempt/$RECOVERY_RETRIES action=gateway_install" if run_gateway_install; then enforce_deadline "after_recovery_install_$attempt" if probe_gateway_health "after_recovery_$attempt"; then log "result=recovered attempt=$attempt" exit 0 fi fi if [[ "$attempt" -lt "$RECOVERY_RETRIES" ]]; then sleep_with_deadline "$RECOVERY_INTERVAL_SECONDS" "recovery_interval_$attempt" fi done ``` ### Technical Analysis The watchdog calculates a global deadline and checks it around sleeps and between recovery operations. However, `openclaw gateway status` and `openclaw gateway install` are executed synchronously without a subprocess timeout. If either command hangs, the shell remains blocked inside command substitution. The subsequent `enforce_deadline` call is never reached. Therefore, `MAX_RUNTIME_SECONDS` is not a hard runtime bound despite the documentation describing it as one. The existing deadline test only checks whether the grace sleep is capped. It does not test hanging status or installation commands. ### Attack Path 1. Execute mode creates and starts the user-level watchdog. 2. The OpenClaw executable becomes unresponsive because of a software defect, blocked I/O, cor ...[truncated 1039 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (52)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code only implements a narrow subset of the declared check mode: parsing a local CHANGELOG and flagging potentially risky entries between two provided versions. It does not perform an actual update check against an external source, does not execute upgrades, and does not create any pre-update recovery watchdog via launchd or systemd. Because the description prominently claims a two-mode assistant including execute mode and update operations, while the code is only a changelog parser/helper, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description centers on an update assistant for OpenClaw, including update discovery/analysis and an execute mode for upgrades with recovery protection. The supplied code is only a recovery watchdog utility focused on Gateway health: it sleeps for a grace period, checks gateway status, and if unhealthy tries openclaw gateway install to recover service availability. This is a related operational support component, but not the described assistant itself. The code lacks any logic for checking available updates, parsing changelogs, making recommendations, confirming/running an upgrade, or orchestrating launchd/systemd protection. Because the code’s primary behavior is materially narrower and different from the declared purpose, this is a mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
*Execute mode (v2, preferred)** uses an external, mock-tested watchdog script (`scripts/recovery-watchdog.sh`) launched before `openclaw update`, so recovery do

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.
md
*Execute mode (v2, preferred)** uses an external, mock-tested watchdog script (`scripts/recovery-watchdog.sh`) launched before `openclaw update`, so recovery do

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 18)May include surrounding context.
md
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 43)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 167)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 168)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 180)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 182)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 183)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 222)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 232)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 234)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 235)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 237)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 238)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 244)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 288)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 298)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 306)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 316)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 324)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 325)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/arm-recovery-watchdog.sh (reported line 348)May include surrounding context.
sh
- **Check mode**: Fetch latest version, parse changelog delta, flag high-risk items, assess relevance to your config - **Execute mode (v2)**: Requires explicit confirmation for a watchdog-assisted flow that starts recovery monitoring before `openclaw update` - **Gateway-independent recovery**: `scripts/recovery-watchdog.sh` checks `openclaw gateway status` after a grace window and runs bounded `openclaw gateway install` retries when needed - **macOS/Linux arming helper**: `scripts/arm-recovery-watchdog.sh` resolves `OPENCLAW_BIN`, then arms and verifies either a macOS LaunchAgent (`launchctl print`) or a Linux systemd user unit (`systemctl --user show`), and cleans up state/log artifacts; the plist template remains inert documentation - **Multi-user safety**: Detects when OpenClaw is owned by a different OS user and stops before creating a duplicate installation - **Dynamic changelog path**: Uses `openclaw update status --json` when available, with npm-global / binary-path / pnpm fallbacks

Static analysis

No suspicious patterns detected.