Openclaw Rescue Kit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:28 AM UTC
• Version: 1.11.0

Overview

This OpenClaw rescue toolkit is mostly purpose-aligned, but it installs persistent automation with several under-scoped operations that can kill processes, rewrite agent state, delete files, or execute writable configuration as shell code.

Install only if you are comfortable with persistent local automation that can restart OpenClaw, kill processes on the gateway port, send configured alerts externally, and clean or rewrite OpenClaw logs, sessions, memory, and configuration history. Review the scripts first, avoid running --auto-schedule until tested, keep notify.conf private, and do not rely on log-cleaner.sh --dry-run as a safe preview in this version.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-config-modify.sh:72

Finding

Arbitrary Shell Command Execution Through the Configuration Modification Interface

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/core.sh:25

Finding

Executable Notification Configuration Loaded by Persistent Jobs

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/gateway-start.sh:20

Finding

Indiscriminate Termination of Processes Based Only on Port Ownership

Content

View full analysis

/dev/null 2>&1; then pids=$(lsof -ti:"$port" 2>/dev/null || true) fi if [ -n "$pids" ]; then for pid in $pids; do if kill -0 "$pid" 2>/dev/null; then kill "$pid" 2>/dev/null || true fi done sleep 5 for pid in $pids; do if kill -0 "$pid" 2>/dev/null; then kill -9 "$pid" 2>/dev/null || true fi done fi } ``` The same unsafe behavior is repeated in `scripts/gateway-watchdog.sh:196-216`. ### Technical Analysis The scripts identify processes solely by whether they own the configured TCP port. They do not verify: - the process executable or command line; - the process owner; - an OpenClaw PID file; - a service-manager unit; - whether the process is actually an OpenClaw gateway. The scripts first send `SIGTERM` and then unconditionally escalate to `SIGKILL`. The behavior can run automatically through the persistent watchdog and modified gateway LaunchAgent. ### Attack Path 1. A legitimate, unrelated process binds the configured port, which defaults to `18789`. 2. The watchdog or startup wrapper decides that the gateway must be restarted. 3. `lsof` returns the unrelated process ID. 4. The script sends `SIGTERM`. 5. If the process remains alive after five seconds, the script sends `SIGKILL`. 6. Persistent service execution may repeatedly terminate the unrelated process whenever it restarts. ### Impact Assessment The script can terminate any same-user process using the configured port. If run with elevated privileges, its termination scope expands to processes accessible to that privileged account. This can cause denial of service, data corruption, int ...[truncated 55 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/log-cleaner.sh:341

Finding

Documented Dry-Run Mode Still Performs Destructive Operations

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/log-cleaner.sh:174

Finding

Scheduled Cleaner Destructively Rewrites Session and Memory Data

Content

View full analysis

/dev/null || echo "$line" done > "$temp_file" if [ -s "$temp_file" ]; then mv "$temp_file" "$file" else mv "${file}.bak-$timestamp" "$file" rm -f "$temp_file" fi rm -f "${file}.bak-$timestamp" } ``` The cleaner is scheduled daily by `scripts/install-rescue-kit.sh:228-237`. ### Technical Analysis For larger session files, the cleaner retains the first records using `head`, although its documentation describes retention of recent records. It also removes `tool_calls`, `tool_results`, and `metadata`, then replaces the original session file. After successful replacement, the immediate backup is deleted. Separate logic also compresses memory Markdown files and removes their original `.md` versions. These are agent state files rather than ordinary disposable logs. ### Attack Path 1. Scheduling is enabled during installation. 2. An active session file grows beyond the configured size threshold. 3. The daily cleaner invokes `clean_session_summarize()`. 4. The function copies only the first N records rather than the latest N records. 5. Tool data and metadata are removed. 6. The temporary result replaces the original session. 7. The local backup is deleted, leaving recent records unavailable. ### Impact Assessment The operation can remove recent conversation records, tool execution evidence, metadata, and memory files. It may degrade future agent behavio ...[truncated 160 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/log-cleaner.sh:323

Finding

Recursive Temporary-File Deletion Is Not Restricted to Skill-Owned Paths

Content

View full analysis

/dev/null && \ deleted=$((deleted + 1)) || true } ``` ### Technical Analysis The cleaner searches recursively from the global `/tmp` directory and deletes every regular file whose name begins with `openclaw` and is older than one day. Filename matching does not establish that a file belongs to this Skill, the current OpenClaw installation, or the current user. The operation is also executed by the daily scheduled cleaner and is not disabled by `--dry-run`. ### Attack Path 1. An unrelated application or user creates a file named `openclaw*` anywhere below `/tmp`. 2. The file remains present for more than one day. 3. The scheduled cleaner executes `find /tmp`. 4. The file matches the name and age predicates. 5. If permissions allow, the cleaner deletes it without ownership or path validation. ### Impact Assessment Accessible files belonging to unrelated workflows can be removed, causing data loss or denial of service. Running the cleaner with elevated privileges would significantly broaden the deletion scope. ]]>

Remediation

View remediation

T06 · System Persistence

Warning

• Location: scripts/install-rescue-kit.sh:274

Finding

Installer Rewrites an Existing Gateway LaunchAgent Before Scheduling Consent

Content

View full analysis

/dev/null || true /usr/libexec/PlistBuddy -c "Add :ProgramArguments array" "$plist" 2>/dev/null || true /usr/libexec/PlistBuddy -c "Add :ProgramArguments:0 string /bin/bash" "$plist" 2>/dev/null || true /usr/libexec/PlistBuddy -c "Add :ProgramArguments:1 string -c" "$plist" 2>/dev/null || true /usr/libexec/PlistBuddy -c \ "Add :ProgramArguments:2 string sleep 5; exec bash $start_script" \ "$plist" 2>/dev/null || true ``` The patch is invoked at `scripts/install-rescue-kit.sh:337-340`, before the later prompt asking whether scheduled tasks should be configured. ### Technical Analysis On macOS, the installer automatically changes an existing `ai.openclaw.gateway.plist` so that future gateway starts execute the Skill's `gateway-start.sh` wrapper. This modification occurs before the installer requests consent for LaunchAgent scheduling. Although the original plist is backed up, individual `PlistBuddy` failures are ignored using `|| true`, which can leave the persistent service in a partially modified state. The inserted wrapper includes the unsafe port-based process termination behavior described in another finding. The persistence is related to the declared gateway-rescue functionality, but modifying an existing startup service without specific consent exceeds the minimum privilege and change scope needed for a basic installation. ### Attack Path 1. A macOS user already has the OpenClaw gateway LaunchAgent installed. 2. The user runs the rescue-kit installer. 3. `patch_gateway_plist()` executes before scheduling consent is requested. 4. Existing `ProgramArguments` are deleted. 5. New arguments are added to execute the Skill-controlled startup wrapper. 6. Future ...[truncated 416 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/git-tag.sh:82

Finding

Overbroad Git Snapshots Can Permanently Retain Plaintext Secrets

Content

View full analysis

/dev/null 2>&1 || true git tag "$tag_name" } ``` ### Technical Analysis The snapshot operation stages nearly every non-ignored file under `~/.openclaw`. The generated ignore list excludes several known directories but does not explicitly exclude all secret-bearing files, including `notify.conf` or secrets stored in `openclaw.json`. If `~/.openclaw` is already a Git repository, the script preserves its existing `.gitignore` and does not enforce the reference exclusions. Secrets committed once remain recoverable from Git objects after the working copy is changed or deleted. The daily baseline task can repeatedly snapshot this broad file set. ### Attack Path 1. A webhook URL, token, API credential, or other secret is stored in a non-ignored file under `~/.openclaw`. 2. A user or scheduled baseline task runs `git-tag.sh`. 3. `git add -A` stages the secret-bearing file. 4. The file is committed and tagged. 5. The user later deletes or rotates the secret in the working tree. 6. A local process or user with access to `~/.openclaw/.git` retrieves the historical value. ### Impact Assessment The issue can expose webhook credentials, gateway tokens, provider settings, and other configuration secrets to any principal that can read the local Git repository. Rollback also operates over the whole tracked tree, so unrelated tracked files may be overwritten when restoring a configuration tag. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (133)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill includes setup for Feishu/Telegram/WeChat/DingTalk alert delivery and local storage of failed alerts, but this outbound messaging capability is not clearly highlighted in the core purpose statement. In a system-management skill, undeclared external communications materially change the trust boundary because logs, host state, or incident details may leave the machine.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill includes setup for Feishu/Telegram/WeChat/DingTalk alert delivery and local storage of failed alerts, but this outbound messaging capability is not clearly highlighted in the core purpose statement. In a system-management skill, undeclared external communications materially change the trust boundary because logs, host state, or incident details may leave the machine.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill includes setup for Feishu/Telegram/WeChat/DingTalk alert delivery and local storage of failed alerts, but this outbound messaging capability is not clearly highlighted in the core purpose statement. In a system-management skill, undeclared external communications materially change the trust boundary because logs, host state, or incident details may leave the machine.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes setup for Feishu/Telegram/WeChat/DingTalk alert delivery and local storage of failed alerts, but this outbound messaging capability is not clearly highlighted in the core purpose statement. In a system-management skill, undeclared external communications materially change the trust boundary because logs, host state, or incident details may leave the machine.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

） | 手动/被其他脚本调用 |

git-tag.sh 使用（配置回滚）

bash

# 查看所有配置快照
bash ~/.openclaw/scripts/git-tag.sh list

# 快速回滚到上一个安全版本
bash ~/.openclaw/scripts/git-tag.sh quick-rollback

# 回滚到指定版本
bash ~/.openclaw/scripts/git-tag.sh rollback <tag-name>

定时任务配置

macOS LaunchAgent（推荐）

macOS 上 crontab 受 SIP 限制，推荐使用 LaunchAgent。

安装脚本会自动生成 plist 到 ~/.openclaw/launchagents-ready/（路径已正确替换）。

如果安装脚本因沙箱权限无法自动复制，请手动执行：

bash

# 复制已准备好的 plist（路径已替换，无需手动修改）
cp ~/.openclaw/launchagents-ready/*.plist ~/Library/LaunchAgents/

# 加载所有服务
launchctl load ~/Library/LaunchAgents/ai.openclaw.watchdog.plist
launchctl load ~/Library/LaunchAgents/ai.openclaw.healthcheck.plist
launchctl load ~/Library/LaunchAgents/ai.openclaw.logcleaner.plist
l

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script uses 'source' on notify.conf, which executes arbitrary shell code in the script's context rather than safely parsing configuration values. If an attacker can modify that file, or if it is populated from an untrusted source, they gain arbitrary code execution with the privileges of whoever runs the diagnostic script.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Blindly deleting a fixed lock file under /tmp is dangerous because /tmp is attacker-writable and vulnerable to symlink and file-replacement attacks. If this script runs with elevated privileges, an attacker may be able to pre-create /tmp/openclaw-gateway.lock as a symlink or manipulate the path so the watchdog deletes an unintended file, causing denial of service or clobbering state.

Content

Scanner excerpt · scripts/gateway-watchdog.sh (reported line 219)May include surrounding context.

sh

fi

    # 清理过期锁文件
    rm -f /tmp/openclaw-gateway.lock 2>/dev/null || true
}

# ==================== 重启网关 ====================

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script advertises a global --dry-run mode, but only clean_rollback_backups receives and respects that flag. Other cleanup routines still execute destructive actions such as rm, mv, gzip-and-delete, and find -delete, which can mislead operators into believing no changes will occur and cause unintended data loss. In a recovery/maintenance skill that users may run during outages, this mismatch is especially dangerous because it encourages use under stress and against valuable logs, sessions, backups, and temp files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script uses source "$NOTIFY_CONF", which executes the configuration file as shell code rather than parsing it as data. If an attacker can modify ~/.openclaw/notify.conf, they can achieve arbitrary command execution whenever the notification script runs, which exceeds the script's stated notification purpose and is especially dangerous for a watchdog/rescue kit likely to run automatically.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/security-hardening.sh (reported line 243)May include surrounding context.

sh

echo ""
            echo "删除多余服务命令  mac:"
            echo "OS: launchctl remove <service-name>"
            echo "  Linux: sudo systemctl stop <service-name> && sudo systemctl disable <service-name>"
        fi
        
        return 1

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises automatic rollback, restart, port cleanup, and log cleaning, but it does not clearly warn users that these actions can modify configuration, terminate processes, or delete operational data without interactive confirmation. In a resilience/ops skill, unattended state-changing behavior is expected, but omitting explicit impact warnings increases the risk of accidental disruption or data loss during deployment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The manual installation instructions copy executable scripts into a persistent user directory and then run an installer from that location, establishing durable local execution artifacts. Persistence is expected for an ops toolkit, but this still creates long-lived code on disk and should be disclosed clearly because it changes the user's environment beyond a one-time command.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

手动安装

bash

mkdir -p ~/.openclaw/scripts ~/.openclaw/logs ~/.openclaw/backups
cp ~/.openclaw/skills/openclaw-rescue-kit/scripts/*.sh ~/.openclaw/scripts/
chmod +x ~/.openclaw/scripts/*.sh
bash ~/.openclaw/scripts/install-rescue-kit.sh

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The webhook setup directs users to send alerts to external services, but it does not warn that logs, hostnames, error details, or other operational metadata may leave the local environment. This can create unintended data disclosure, especially if alerts contain sensitive configuration or incident details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The LaunchAgent and cron examples enable unattended recurring execution of watchdog, health check, log cleanup, and Git tagging tasks, but the README does not clearly warn that these jobs will continue running automatically and may repeatedly modify system state. This raises the chance of persistent unexpected behavior, repeated restarts, or ongoing file changes after installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Copying plist files into ~/Library/LaunchAgents installs persistent per-user background job definitions that survive beyond the current session. In context this is intentional watchdog automation, but it still creates durable background execution and should be treated as a state-changing action requiring explicit consent and removal instructions.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

bash

# plist 已生成到 ~/.openclaw/launchagents-ready/
cp ~/.openclaw/launchagents-ready/*.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.*.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The launchctl load command actively enables the LaunchAgents so they begin running automatically in future sessions and possibly immediately. This is legitimate for a watchdog skill, but without a strong warning and disable instructions it can surprise users with persistent background behavior and recurring process execution.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

bash

# plist 已生成到 ~/.openclaw/launchagents-ready/
cp ~/.openclaw/launchagents-ready/*.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.*.plist

Linux crontab

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The launchctl load command actively enables the LaunchAgents so they begin running automatically in future sessions and possibly immediately. This is legitimate for a watchdog skill, but without a strong warning and disable instructions it can surprise users with persistent background behavior and recurring process execution.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

bash

# plist 已生成到 ~/.openclaw/launchagents-ready/
cp ~/.openclaw/launchagents-ready/*.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.*.plist

Linux crontab

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 143)May include surrounding context.

cat ~/.openclaw/logs/unsent_alerts.log

配置回滚失败

ls -la ~/.openclaw/backups/ bash ~/.openclaw/scripts/git-tag.sh list

text

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

cat ~/.openclaw/logs/unsent_alerts.log

配置回滚失败

ls -la ~/.openclaw/backups/ bash ~/.openclaw/scripts/git-tag.sh list

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and instructs shell execution, file copying, service installation, and scheduler setup, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That omission weakens reviewability and can cause the skill to be invoked or trusted without clear disclosure that it drives persistent system-level shell actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation text is broad enough to match many ordinary support situations such as crashes, rollback, cleanup, or deployment help. In context, that increases the chance this skill is invoked inappropriately and then suggests persistent shell-based system modifications that may exceed what the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The installation instructions direct users to create directories, copy executable scripts, chmod them, and run an installer, all without a strong warning that these commands change the local system and may establish persistent background behavior. In a skill context, this is risky because users may treat the commands as routine troubleshooting steps and not appreciate the level of access or persistence being introduced.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The manual installation sequence writes executables into a persistent user directory and prepares them for later automated use. While not persistence by itself to the same degree as cron or LaunchAgents, it lays the groundwork for long-lived system modification and should be treated as a security-relevant behavior in a skill.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

手动安装

bash

mkdir -p ~/.openclaw/scripts ~/.openclaw/logs ~/.openclaw/backups
cp ~/.openclaw/skills/openclaw-rescue-kit/scripts/*.sh ~/.openclaw/scripts/
chmod +x ~/.openclaw/scripts/*.sh
bash ~/.openclaw/scripts/install-rescue-kit.sh

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The LaunchAgent guidance explicitly recommends a persistence mechanism for macOS background execution. Persistent agents can continue running independently of user intent, and in this skill they are meant to monitor, restart, and modify application state over time.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

macOS 上 crontab 受 SIP 限制，推荐使用 LaunchAgent。

安装脚本会自动生成 plist 到 `~/.openclaw/launchagents-ready/`（路径已正确替换）。

如果安装脚本因沙箱权限无法自动复制，请手动执行：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Copying plists into ~/Library/LaunchAgents installs per-user startup jobs, a classic persistence method. This is not inherently malicious in an admin toolkit, but it is security-sensitive and dangerous when presented without strong disclosure because it causes commands to run automatically on future sessions.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

如果安装脚本因沙箱权限无法自动复制，请手动执行：

bash

# 复制已准备好的 plist（路径已替换，无需手动修改）
cp ~/.openclaw/launchagents-ready/*.plist ~/Library/LaunchAgents/

# 加载所有服务

Static analysis

No suspicious patterns detected.