Gateway Self-Heal Watchdog

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

The skill is a real OpenClaw gateway watchdog, but it installs persistent scheduled execution and includes unsafe cron and root-service guidance that users should review carefully before installing.

Install only if you explicitly want a persistent OpenClaw gateway watchdog. Before running setup, back up your crontab and OpenClaw config, avoid the root systemd example unless rewritten for an unprivileged user, replace broad cron removal with exact markers, set restrictive permissions on ~/.openclaw/watchdog.sh and config backups, and add retry/retention limits so transient failures do not repeatedly roll back config or fill disk.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-watchdog.sh:121

Finding

Overbroad Cron Filtering Can Delete Unrelated Scheduled Tasks

Content

View full analysis

/dev/null | grep -v "watchdog.sh") | crontab - # Add new cron job (crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab - ``` Related unsafe removal instructions also appear in: ```bash crontab -l | grep -v watchdog | crontab - ``` at `SKILL.md:44` and `scripts/setup-watchdog.sh:137`. ### Technical Analysis The installer removes every cron entry containing the generic substring `watchdog.sh`, rather than removing only the exact entry owned by this skill. The documented uninstall command is even broader and removes every line containing `watchdog`. Consequently, unrelated monitoring, backup, security, or maintenance tasks can be silently deleted. The read-filter-write approach also lacks synchronization: a concurrent cron update occurring between the two `crontab -l` operations can be lost. The watchdog's user-level cron registration is consistent with its declared self-healing function and does not itself exceed the required privilege boundary. The unsafe matching and modification strategy, however, affects cron entries outside the skill's ownership. ### Attack Path 1. The user already has an unrelated cron task whose command or path contains `watchdog.sh` or `watchdog`. 2. The user runs `scripts/setup-watchdog.sh`, or follows the documented removal command. 3. `grep -v` removes the unrelated entry along with the OpenClaw entry. 4. The modified cron table is installed without warning or backup. 5. The unrelated monitoring or maintenance task ceases to run, potentially concealing failures or causing service disruption. A local process that can race cron modifications could also arrange for legitimate concurrent changes to be overwritten. ### Impact Assessment The impact is limited t ...[truncated 252 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/systemd.md:9

Finding

Documented Systemd Watchdog Runs Persistently as Root Without Demonstrated Need

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-watchdog.sh:50

Finding

Broad Process Matching and Single-Sample Health Checks Can Trigger Incorrect Recovery Actions

Content

View full analysis

/dev/null 2>&1; then log "LEVEL1: Gateway process not found → restarting" openclaw gateway start >> "$LOG" 2>&1 sleep 5 if pgrep -f "openclaw" > /dev/null 2>&1; then log "LEVEL1: Restart successful" else log "LEVEL1: Restart failed → trying config rollback" # Fall through to Level 2 fi fi # Level 2: Health check (process alive but possibly broken) if pgrep -f "openclaw" > /dev/null 2>&1; then HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:$HEALTH_PORT/health" --max-time 10 2>/dev/null || echo "000") if [ "$HTTP_CODE" = "200" ]; then # Healthy → update backup with current good config cp "$CONF" "$BAK" # Silent success, no log spam exit 0 fi # Health check failed log "LEVEL2: Health check failed (HTTP $HTTP_CODE)" if [ -f "$BAK" ]; then # Save broken config for debugging cp "$CONF" "$CONF.broken.$(date +%s)" # Rollback to last known good cp "$BAK" "$CONF" log "LEVEL2: Config rolled back from backup" ``` ### Technical Analysis `pgrep -f "openclaw"` searches complete command lines for a generic substring. It does not verify the gateway's executable, arguments, PID file, ownership, or service identity. It can match unrelated OpenClaw commands, attacker-created processes, and potentially command lines containing the `.openclaw` directory or watchdog path. The recovery decision is then based on one HTTP request. A single timeout, temporary startup delay, overloaded gateway, or transient local networking failure is interpreted as configuration corruption. The script immediately preserves the current configuration, replaces it with the backup, and restarts the gateway. There is no re ...[truncated 1554 chars]

Remediation

View remediation

/exe` on Linux or an equivalent platform API. - Require multiple consecutive health-check failures before rollback. - Add a startup grace period and distinguish connection failures from application-level authentication or configuration failures. - Validate the backup before restoration and compare configuration versions or hashes. - Attempt a non-destructive restart before rolling back configuration unless there is direct evidence of configuration corruption. - Correct curl status handling, for example: ```bash if ! HTTP_CODE=$(/usr/bin/curl -sS -o /dev/null -w '%{http_code}' \ --max-time 10 "http://127.0.0.1:${HEALTH_PORT}/health"); then HTTP_CODE="000" fi ``` - Add an exclusive lock so only one watchdog instance can perform recovery at a time. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-watchdog.sh:77

Finding

Unbounded Broken-Configuration Archives Permit Disk Exhaustion and Retain Sensitive Data

Content

View full analysis

` file. 4. The files accumulate indefinitely. 5. Over time, the user's filesystem or quota can be exhausted, disrupting OpenClaw and other applications. 6. Any account or process with read access to the directory gains additional opportunities to recover historical configuration secrets. A local attacker who can keep the health endpoint unavailable can accelerate this condition, but ordinary persistent service failure is sufficient. ### Impact Assessment The primary impact is denial of service through disk or quota exhaustion. Secondary impact includes unnecessary retention and potential disclosure of historical configuration secrets. The scope normall ...[truncated 113 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/docker.md:3

Finding

Docker Example Installs an Unpinned Package as Root

Content

View full analysis

Remediation

View remediation

`. - Build in a controlled environment and scan the resulting image and dependency tree. - Disable lifecycle scripts when they are not required, or separately audit all required scripts. - Use a multi-stage build and run the final application as a dedicated non-root user. - Establish an update process that reviews and tests dependency changes before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises autonomous backup, rollback, restart, and recovery behavior, but the visible file only provides descriptive claims and manual commands. This mismatch is dangerous because users and orchestration systems may trust the skill to provide self-healing safeguards that do not actually exist, leading to unsafe changes, failed recovery, or false assurance during outages.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill clearly instructs the agent to run shell commands and install persistence via scripts and cron, but it declares no tool scope or permissions boundary. That creates an authorization gap where a model or runner could invoke system-changing shell behavior without the skill explicitly constraining or signaling those capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases include broad operational language such as watchdog, self-heal, gateway down, and config recovery, which can match many routine troubleshooting requests. Over-broad activation can cause this skill to be selected in contexts where the user did not intend persistence, restart behavior, or config manipulation, increasing the chance of unsafe system actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown instructs installation of a cron-based watchdog, automatic rollback, restart behavior, and config backup without clearly warning that these actions alter system persistence, may overwrite backups, and can revert configuration unexpectedly. In a system-management context, omission of impact warnings increases the risk of accidental disruption, loss of desired config changes, or unauthorized persistence on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Creating ~/.openclaw/watchdog.sh and registering it as a cron job creates a persistent execution path that continues outside the immediate interaction. In the context of an agent skill, this is sensitive because it writes executable content and schedules recurring execution, which can be abused or cause unintended long-lived changes if selected in the wrong context.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

text

This will:
- Create the watchdog script at `~/.openclaw/watchdog.sh`
- Register it as a cron job (every minute)
- Take an initial config backup

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill includes commands to manipulate crontab entries, which establishes or removes persistent scheduled execution on the host. Even though the stated purpose is operational maintenance, persistence mechanisms are security-sensitive because they can survive the session and continue executing without ongoing user awareness.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

cat ~/.openclaw/watchdog.log | tail -20

Disable watchdog

crontab -l | grep -v watchdog | crontab -

text

## Recovery Levels

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchd.md (reported line 5)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchd.md (reported line 6)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchd.md (reported line 24)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchd.md (reported line 27)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchd.md (reported line 30)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/launchd.md (reported line 5)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Loading a LaunchAgent establishes persistent automatic execution at login, which can be abused if the referenced watchdog.sh is modified, unsafe, or attacker-controlled. In this skill context the persistence is intentional and operationally justified, but it still increases attack surface because any compromise of the script or its writable directory will execute repeatedly without further prompts.

Content

Scanner excerpt · references/launchd.md (reported line 31)May include surrounding context.

bash

# Replace USERNAME in the plist first
sed -i '' "s/USERNAME/$(whoami)/g" ~/Library/LaunchAgents/ai.openclaw.watchdog.plist

launchctl load ~/Library/LaunchAgents/ai.openclaw.watchdog.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

launchctl load activates persistent execution of the watchdog from the user's LaunchAgents directory, creating a durable foothold if the underlying script is unsafe or later tampered with. Although the stated purpose is benign self-healing, persistence mechanisms are security-relevant because they can be repurposed for unauthorized code execution within the user session.

Content

Scanner excerpt · references/launchd.md (reported line 33)May include surrounding context.

Replace USERNAME in the plist first

sed -i '' "s/USERNAME/$(whoami)/g" ~/Library/LaunchAgents/ai.openclaw.watchdog.plist

launchctl load ~/Library/LaunchAgents/ai.openclaw.watchdog.plist

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

launchctl load activates persistent execution of the watchdog from the user's LaunchAgents directory, creating a durable foothold if the underlying script is unsafe or later tampered with. Although the stated purpose is benign self-healing, persistence mechanisms are security-relevant because they can be repurposed for unauthorized code execution within the user session.

Content

Scanner excerpt · references/launchd.md (reported line 33)May include surrounding context.

Replace USERNAME in the plist first

sed -i '' "s/USERNAME/$(whoami)/g" ~/Library/LaunchAgents/ai.openclaw.watchdog.plist

launchctl load ~/Library/LaunchAgents/ai.openclaw.watchdog.plist

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/systemd.md (reported line 30)May include surrounding context.

text

```bash
sudo systemctl enable openclaw-watchdog.timer
sudo systemctl start openclaw-watchdog.timer

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/systemd.md (reported line 31)May include surrounding context.

text

```bash
sudo systemctl enable openclaw-watchdog.timer
sudo systemctl start openclaw-watchdog.timer

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/systemd.md (reported line 30)May include surrounding context.

text

```bash
sudo systemctl enable openclaw-watchdog.timer
sudo systemctl start openclaw-watchdog.timer

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The script installs a cron entry that runs every minute, creating persistence on the host without additional confirmation or scoping. Although this appears intended for legitimate watchdog functionality, persistence mechanisms are security-relevant because they survive the initiating session and can be abused if the script path or watched files are later modified.

Content

Scanner excerpt · scripts/setup-watchdog.sh (reported line 122)May include surrounding context.

sh

CRON_JOB="* * * * * $WATCHDOG"

# Remove existing watchdog cron if any
(crontab -l 2>/dev/null | grep -v "watchdog.sh") | crontab -

# Add new cron job
(crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

Adding the watchdog script to crontab every minute establishes automatic recurring execution, which is a classic persistence behavior. In this skill context the intent is operational resilience, but the mechanism still increases attack surface because any compromise of the referenced script or environment yields repeated code execution.

Content

Scanner excerpt · scripts/setup-watchdog.sh (reported line 125)May include surrounding context.

sh

(crontab -l 2>/dev/null | grep -v "watchdog.sh") | crontab -

# Add new cron job
(crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab -
echo "✅ Cron 등록 완료 (매분 실행)"

# 5. Initial run

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-watchdog.sh (reported line 137)May include surrounding context.

sh

echo "=========================="

# Cron registered?
if crontab -l 2>/dev/null | grep -q "watchdog.sh"; then
  echo "✅ Cron: 등록됨 (매분 실행)"
else
  echo "❌ Cron: 미등록"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/watchdog-status.sh (reported line 13)May include surrounding context.

sh

echo "=========================="

# Cron registered?
if crontab -l 2>/dev/null | grep -q "watchdog.sh"; then
  echo "✅ Cron: 등록됨 (매분 실행)"
else
  echo "❌ Cron: 미등록"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Several user-facing status messages are written in Korean, and the script does not provide any opt-in, configuration, or explanation for this locale choice. This can violate language/locale policy when users are not given a choice and the region-specific constraint is not documented.

Content

No source excerpt is available for this finding.