ZeroTier Remote Web Access

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:43 AM UTC
• Version: 1.0.1

Overview

This skill is aimed at remote OpenClaw access, but it exposes the gateway more broadly than the stated ZeroTier-only purpose and weakens authentication controls.

Review carefully before installing. Use this only on a trusted host and network, avoid the pipe-to-sudo installer, do not bind the gateway to 0.0.0.0, keep device authentication enabled, restrict firewall rules to the ZeroTier interface or subnet, and rotate any token that appears in terminal logs or backups.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25
• Finding: Unverified Remote Installer Executed with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-27` **Vulnerability Type**: Remote payload retrieval and privileged execution **Risk Level**: Critical ### Vulnerable Code ```bash # If not installed curl https://install.zerotier.com | sudo bash ``` ### Technical Analysis The documentation instructs the user to download a mutable shell script and immediately execute it as root. There is no package-version pinning, cryptographic signature verification, checksum validation, or opportunity to inspect the downloaded content before execution. The effective privileged payload can change after the Skill has been reviewed. Compromise of the hosting infrastructure, DNS resolution, TLS termination, or the installer itself would consequently provide an attacker with an immediate root-level execution channel. ### Attack Path 1. An attacker compromises or causes modification of the installer returned from `https://install.zerotier.com`. 2. A user follows the installation command in the Skill documentation. 3. `curl` retrieves the attacker-controlled response. 4. The shell pipeline passes the response directly to `sudo bash`. 5. The payload executes with root privileges without integrity verification. ### Impact Assessment Successful exploitation permits arbitrary command execution as root, including installation of persistent services, theft or modification of all locally accessible data, credential extraction, security-control alteration, and full operating-system compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer installation through an authenticated operating-system package repository. - Pin the package or installer to a reviewed version. - Download the installer to a local file instead of piping it directly to a shell. - Verify a vendor-published cryptographic signature or pinned checksum before execution. - Display the script for review and obtain explicit consent before invoking `sudo`. - Document the files, services, network access, and persistence introduced by installation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/enable-remote.mjs:69
• Finding: Gateway Exposed on All Interfaces with Authentication Protections Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enable-remote.mjs:69-91`; related instructions at `SKILL.md:72,129-137,151,186-187` **Vulnerability Type**: Excessive network exposure and weakened access control **Risk Level**: Critical ### Vulnerable Code ```js config.gateway = { ...config.gateway, port: 1880, mode: 'local', bind: 'custom', customBindHost: '0.0.0.0', // Bind every network interface controlUi: { ...(config.gateway?.controlUi || {}), allowedOrigins: [ `http://localhost:1880`, `http://127.0.0.1:1880`, `http://${ztIP}:1880`, ], allowInsecureAuth: true, dangerouslyDisableDeviceAuth: true, }, auth: { ...(config.gateway?.auth || {}), mode: 'token', token: config.gateway?.auth?.token || generateToken(), }, }; ``` The documentation additionally recommends: ```bash sudo ufw allow 9993/udp # ZeroTier port sudo ufw allow 1880/tcp # Gateway port ``` ### Technical Analysis The declared purpose only requires access through the ZeroTier interface. Binding to `0.0.0.0` instead exposes the OpenClaw management gateway on every IPv4 interface, potentially including physical LAN, public, container, bridge, and unrelated VPN interfaces. The configuration simultaneously enables insecure authentication and explicitly disables device authentication. The firewall instruction is not scoped to the ZeroTier interface or subnet, further broadening reachability. These changes exceed the minimum access required for ZeroTier-based remote access. CORS origin restrictions do not compensate for network-level exposure or disabled authentication protections because non-browser clients can directly contact the service. ### Attack Path 1. A user runs `enable-remote.mjs`. 2. The script changes the gateway bind address to `0.0.0.0`. 3. Device authentication is disabled and insecure authentication is enabled. 4. The user follows the firewall instructions and permits TCP port 1880 without an in ...[truncated 639 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bind `customBindHost` to the validated ZeroTier address rather than `0.0.0.0`. - Retain device authentication and secure authentication; do not set either dangerous flag. - Refuse to continue if exactly one suitable ZeroTier interface and address cannot be established. - Scope firewall access to the ZeroTier interface, for example with an interface-specific rule, and restrict source addresses to the expected ZeroTier subnet where possible. - Preserve the existing port unless changing it is required and explicitly approved. - Warn users before broadening network exposure and require explicit confirmation. - Verify the actual listening address after restart and fail closed if the service listens on unintended interfaces. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/enable-remote.mjs:87
• Finding: Gateway Bearer Token Printed in Plaintext and Copied into Backups<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enable-remote.mjs:87-103,165-169` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```js auth: { ...(config.gateway?.auth || {}), mode: 'token', // Generate a new token or retain the existing token token: config.gateway?.auth?.token || generateToken(), }, ``` ```js return { oldPort, oldBind, newPort: 1880, newBind: 'custom', newHost: ztIP, token: config.gateway.auth.token, }; ``` ```js log(COLORS.cyan, '\n🔐 Authentication Token:'); log(COLORS.yellow, ` ${configChanges.token}`); ``` Before modification, the script also copies the complete configuration, including any existing token: ```js copyFileSync(configPath, backupPath); ``` ### Technical Analysis The gateway bearer token is deliberately returned from the configuration-update function and printed in full. Terminal capture, Agent transcripts, shell automation logs, screen sharing, or support diagnostics can therefore disclose the credential. Configuration backups preserve the same credential. `copyFileSync` does not explicitly enforce restrictive permissions, and the script does not verify that either the original file or generated backup is accessible only to the owner. ### Attack Path 1. The user runs the enable script in an Agent session, terminal recorder, CI job, or other logged environment. 2. The script prints the complete gateway token. 3. Another user or attacker gains access to the transcript, terminal output, or backup file. 4. The attacker connects to the exposed gateway and supplies the recovered bearer token. 5. The gateway treats the attacker as authenticated. ### Impact Assessment Token disclosure can grant the holder the same gateway access as the legitimate user. Because the gateway is configured to listen on every interface, compromise may be remotely exploitable from multiple networks. The resulting scope depends on OpenClaw configuration but m ...[truncated 104 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never print the complete bearer token; display only a short redacted fingerprint. - Tell the user where the protected configuration is stored rather than revealing its value. - Create configuration and backup files with mode `0600`. - Verify and correct existing file permissions before reading or copying credentials. - Avoid retaining obsolete credential-bearing backups indefinitely. - Rotate the token after any suspected transcript, log, or backup disclosure. - Prefer a dedicated secure credential store when supported. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check-status.mjs:108
• Finding: Shell Command Injection Through Configuration-Derived Port<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check-status.mjs:108-118` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```js function checkPortListening() { const configPath = join(process.env.HOME, '.openclaw', 'openclaw.json'); let port = 1880; try { const config = JSON.parse(readFileSync(configPath, 'utf8')); port = config.gateway?.port || 1880; } catch (e) {} const output = runCommand(`ss -tlnp 2>/dev/null | grep :${port}`); if (output) { log(COLORS.green, `✅ Port listening: ${port} is open`); return true; } log(COLORS.red, `❌ Port listening: ${port} is not open`); return false; } ``` The command reaches: ```js return execSync(cmd, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] }); ``` ### Technical Analysis The `gateway.port` value is loaded from JSON without type, range, or syntax validation and interpolated directly into a command interpreted by a shell. JSON does not require this property to be numeric. A value containing shell metacharacters can terminate or extend the intended `grep` command. For example, a malicious string structurally equivalent to `1880; attacker-command` would cause the shell to execute the additional command when the status script runs. ### Attack Path 1. An attacker or compromised local component obtains write access to `~/.openclaw/openclaw.json`. 2. The attacker sets `gateway.port` to a string containing shell metacharacters and an operating-system command. 3. A user or Agent runs `check-status.mjs`. 4. The script interpolates the untrusted value into the `ss | grep` shell pipeline. 5. `execSync` invokes a shell, which interprets and executes the injected command. ### Impact Assessment Injected commands execute with the privileges of the user running the status script. This can permit access to that user's files, OpenClaw configuration and credentials, modification of workspace content, execution of additional paylo ...[truncated 128 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require the port to be an integer and reject all other types. - Enforce the valid TCP port range of 1 through 65535. - Replace `execSync` shell strings with `execFileSync` or `spawnSync` and fixed argument arrays. - Avoid `grep` pipelines; retrieve socket information through a structured API or parse the output in JavaScript. - Treat configuration content as untrusted even when it is stored under the user's home directory. - Add tests using strings containing semicolons, command substitution, pipes, spaces, and newline characters. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:157
• Finding: ZeroTier Service Persistence Enabled Without Explicit Lifecycle Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:157-160` **Vulnerability Type**: Persistent startup-service registration **Risk Level**: Medium ### Vulnerable Code ```bash # Problem 1: ZeroTier service is not running systemctl start zerotier-one systemctl enable zerotier-one ``` ### Technical Analysis `systemctl enable` configures ZeroTier to start automatically across reboots. Persistent ZeroTier operation can be reasonable when a user explicitly requests durable remote access, but it is not necessary for a one-time session or a simple service-status repair. The instruction is presented as routine troubleshooting and does not explain that it changes boot-time behavior, obtain explicit consent for persistence, or provide a corresponding disable-and-stop procedure. The Skill's own disable script only restores OpenClaw's local binding and does not disable ZeroTier persistence. ### Attack Path 1. A user encounters an inactive ZeroTier service. 2. The user follows the documented troubleshooting commands. 3. `systemctl enable zerotier-one` registers the daemon for automatic startup. 4. The daemon continues starting after future reboots even after OpenClaw remote access is no longer needed. 5. Membership in the overlay network and its associated attack surface persist across sessions. ### Impact Assessment This does not by itself establish a confirmed malicious backdoor, but it creates cross-session network persistence beyond the minimum privilege required for temporary access. A compromised or overly permissive ZeroTier network may retain connectivity to the host whenever it boots. Enabling the service normally requires administrative authorization. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Use `systemctl start zerotier-one` for temporary access by default. - Present service enablement as a separate optional action. - Explain that enablement survives reboot and request explicit user consent. - Document a complete removal command such as `systemctl disable --now zerotier-one`. - Consider leaving service lifecycle management to the user or operating-system package manager. - Make the disable workflow optionally stop and disable ZeroTier after confirming that no other application depends on it. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/disable-remote.mjs:41
• Finding: Disable Workflow Leaves Dangerous Authentication Flags Enabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/disable-remote.mjs:41-55`; dangerous values originate at `scripts/enable-remote.mjs:78-85` **Vulnerability Type**: Incomplete security rollback **Risk Level**: Medium ### Vulnerable Code The enable workflow introduces the dangerous settings: ```js controlUi: { ...(config.gateway?.controlUi || {}), allowedOrigins: [ `http://localhost:1880`, `http://127.0.0.1:1880`, `http://${ztIP}:1880`, ], allowInsecureAuth: true, dangerouslyDisableDeviceAuth: true, }, ``` The disable workflow preserves all pre-existing `controlUi` properties through object spreading and changes only `allowedOrigins`: ```js config.gateway = { ...config.gateway, port: 18789, bind: 'loopback', controlUi: { ...(config.gateway?.controlUi || {}), allowedOrigins: [ 'http://localhost:18789', 'http://127.0.0.1:18789', ], }, }; // Remove customBindHost delete config.gateway.customBindHost; ``` ### Technical Analysis Object spreading copies `allowInsecureAuth: true` and `dangerouslyDisableDeviceAuth: true` into the supposedly restored configuration. The script changes the network binding but does not restore the original authentication state. This creates a latent insecure configuration. If another administrator, script, upgrade, or configuration operation later exposes the gateway again, it may become remotely reachable while device authentication remains disabled. ### Attack Path 1. The user runs the enable workflow, which disables device authentication and permits insecure authentication. 2. The user later runs the advertised disable workflow. 3. The gateway returns to loopback, but the dangerous authentication flags remain in the configuration. 4. A later configuration change exposes the gateway through LAN, VPN, container, proxy, or public networking. 5. An attacker reaches the gateway while the preserved weak authentication state remains active. ### Impact Assessment Th ...[truncated 260 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restore the complete backed-up configuration rather than reconstructing selected fields. - Explicitly remove or reset `allowInsecureAuth` and `dangerouslyDisableDeviceAuth`. - Record original values before modification and restore those exact values. - Make configuration updates atomic so failed restarts do not leave partially modified state. - Verify the final binding and authentication state after rollback. - Add an automated enable-disable test asserting that the final configuration is semantically identical to the original. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enable-remote.mjs:111
• Finding: Parse-Blocking Await Usage Makes Enable and Disable Workflows Inoperable<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enable-remote.mjs:111-114`; also `scripts/disable-remote.mjs:92-99` **Vulnerability Type**: Security workflow availability and recovery failure **Risk Level**: Medium ### Vulnerable Code ```js function generateToken() { const crypto = await import('crypto'); return crypto.randomBytes(20).toString('hex'); } ``` The disable script contains the same defect: ```js function listBackups() { const { execSync } = await import('child_process'); try { const output = execSync( 'ls -lt ~/.openclaw/openclaw.json.backup-* 2>/dev/null | head -5', { encoding: 'utf8' } ); ``` ### Technical Analysis Both files use `await` inside ordinary functions that are not declared `async`. In standard Node.js ESM parsing, this is invalid syntax. The entire module is rejected before execution, regardless of whether the affected function is eventually called. Consequently, the supplied enable and disable workflows cannot reliably execute. The defect is security-relevant because the advertised rollback mechanism is unavailable, potentially leaving users dependent on manual commands or unable to restore a secure local-only state. ### Attack Path 1. A user attempts to enable or disable remote access using the documented Node.js command. 2. Node.js parses the module before running its main body. 3. Parsing encounters `await` inside a non-`async` function. 4. Node.js terminates with a syntax error. 5. The intended configuration or security rollback is not performed. 6. A user may incorrectly assume the operation succeeded or resort to error-prone manual recovery commands. ### Impact Assessment The primary impact is loss of availability and reliability of security-sensitive configuration management. In particular, failure of the disable workflow can delay restoration of local-only access. No direct privilege escalation results from the syntax defect alone. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Use a static import such as `import { randomBytes } from 'node:crypto'`. - Alternatively, declare the functions `async` and correctly await their returned promises at every call site. - Remove the redundant dynamic `child_process` import because `execSync` is already statically imported. - Run `node --check` against every script in automated testing. - Add end-to-end tests for enablement, restart verification, disablement, and backup restoration. - Ensure rollback remains available even if an earlier workflow step fails. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill presents the setup as safe because it avoids direct public Internet exposure, but later instructs binding the gateway to all interfaces and weakening auth. That mismatch is dangerous because users may underestimate the exposure created by `0.0.0.0` and trust ZeroTier as a substitute for application-layer authentication.

External Script Fetching

High

• Category: Supply Chain

Content

systemctl status zerotier-one
   
   # 如果未安装
   curl https://install.zerotier.com | sudo bash
   ```

2. **已加入 ZeroTier 网络**

• Confidence: 99% confidence
• Finding: The documentation instructs fetching and executing an external script directly from the Internet. This is a classic supply-chain risk because users are encouraged to trust remote code without review, signature verification, or integrity checks, and it executes with elevated privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

systemctl status zerotier-one
   
   # 如果未安装
   curl https://install.zerotier.com | sudo bash
   ```

2. **已加入 ZeroTier 网络**

• Confidence: 98% confidence
• Finding: The command chains network retrieval directly into privileged shell execution, eliminating opportunities for review or integrity validation. This magnifies the impact of any compromise of the upstream script or user environment into immediate root-level code execution.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The enablement steps emphasize convenience and automatic reconfiguration but do not prominently warn that the service will become remotely reachable and that the shown configuration weakens authentication. Users following the instructions could unintentionally expose a sensitive control interface to all ZeroTier peers or additional interfaces.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The documentation explicitly recommends `allowInsecureAuth: true` and `dangerouslyDisableDeviceAuth: true` while exposing the web interface remotely. This weakens authentication controls for a network-exposed service and is not necessary for the stated ZeroTier-only remote access use case, increasing the chance of unauthorized access if the overlay network is misconfigured or a peer is compromised.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script claims to enable ZeroTier-only remote access, but it sets `customBindHost` to `0.0.0.0`, exposing the gateway on every network interface, including LAN and potentially other reachable networks. Combined with `allowInsecureAuth: true` and `dangerouslyDisableDeviceAuth: true`, this broadens exposure far beyond the stated trust boundary and can enable unauthorized remote access if the host is reachable.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

systemctl status zerotier-one
   
   # 如果未安装
   curl https://install.zerotier.com | sudo bash
   ```

2. **已加入 ZeroTier 网络**

• Confidence: 98% confidence
• Finding: This line runs a remote installation script fetched over the network directly into `sudo bash`, granting root privileges to unaudited content. If the installer source, transport, or hosting is compromised, the system can be fully compromised immediately.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

2. **已加入 ZeroTier 网络**
   ```bash
   # 加入网络 (需要 Network ID)
   sudo zerotier-cli join <Network-ID>
   
   # 在 zerotier.com 网页授权设备
   ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

```bash
# 列出所有备份
ls -la ~/.openclaw/openclaw.json.backup-*

# 恢复到指定备份
cp ~/.openclaw/openclaw.json.backup-20260304-152800 ~/.openclaw/openclaw.json

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 问题 1: ZeroTier 服务未运行
```bash
systemctl start zerotier-one
systemctl enable zerotier-one
```

### 问题 2: 设备未授权

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

zerotier-cli listnetworks

# 检查防火墙
sudo ufw allow 9993/udp  # ZeroTier 端口
sudo ufw allow 1880/tcp  # Gateway 端口

# 测试连通性

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 检查防火墙
sudo ufw allow 9993/udp  # ZeroTier 端口
sudo ufw allow 1880/tcp  # Gateway 端口

# 测试连通性
ping <ZeroTier-IP>

• Confidence: 94% confidence
• Finding: Opening TCP 1880 at the firewall expands reachability of the gateway beyond local-only access. In the context of this skill, that is particularly risky because the documented gateway configuration also weakens authentication, so the firewall rule materially increases exposure to unauthorized access.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains user-facing natural-language output and comments centered on Chinese, including the top-level description and subsequent console messages, without any opt-in or alternative locale. That creates a language/locale policy concern because the skill effectively forces one language for interaction rather than offering user choice or documenting a justified region-specific constraint.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code performs a direct write to the user's OpenClaw configuration, changing port, bind mode, and allowed origins. Although it logs success afterward, there is no confirmation prompt or advance user-facing warning immediately before the irreversible config modification.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script kills the existing gateway process and starts a new one using subprocess execution. While progress messages are printed, there is no explicit user confirmation before disrupting the running service, which is a safety-relevant operational change.

Session Persistence

Medium

• Category: Rogue Agent

Content

runCommand('pkill -f "openclaw-gateway"', true);
  runCommand('sleep 2', true);
  runCommand(`nohup openclaw gateway > /tmp/openclaw-gateway.log 2>&1 &`, true);
  runCommand('sleep 5', true);
  
  const checkOutput = runCommand('pgrep -f "openclaw-gateway"', true);

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

runCommand('pkill -f "openclaw-gateway"', true);
  runCommand('sleep 2', true);
  runCommand(`nohup openclaw gateway > /tmp/openclaw-gateway.log 2>&1 &`, true);
  runCommand('sleep 5', true);
  
  const checkOutput = runCommand('pgrep -f "openclaw-gateway"', true);

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

runCommand('pkill -f "openclaw-gateway"', true);
  runCommand('sleep 2', true);
  runCommand(`nohup openclaw gateway > /tmp/openclaw-gateway.log 2>&1 &`, true);
  runCommand('sleep 5', true);
  
  const checkOutput = runCommand('pgrep -f "openclaw-gateway"', true);

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script starts the service with `openclaw gateway` but verifies restart success using `pgrep -f "openclaw-gateway"`, which may not match the actual spawned process name. This can produce false success or false failure states, leaving operators believing remote access has been disabled when the gateway may not have restarted correctly or may still be running in an unexpected state.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file contains user-facing natural-language strings in Chinese, including status output and setup instructions, but does not provide any opt-in or alternative locale. Per the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: `generateToken()` uses `await import('crypto')` but is declared as a normal function and then called synchronously, so token generation is broken and may crash or mis-store the token value. This can leave the service in an inconsistent authentication state, undermining the intended protection for an already remotely exposed gateway.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file presents all operational guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The script's descriptive text, logs, and user-facing status messages are largely in Chinese, which imposes a language choice on users. The file does not provide an English alternative, locale selection, or any documented justification for the language restriction.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-status.mjs:25

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/disable-remote.mjs:26

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/enable-remote.mjs:26