Gateway Env Injector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-built for configuring OpenClaw secrets, but it makes misleading safety claims while persistently storing API keys and a 1Password token in a LaunchAgent plist.

Review carefully before installing. This skill can expose OpenAI, Anthropic, Gemini, Mistral, Voyage, Hugging Face, and 1Password credentials in a persistent LaunchAgent plist and process environment. Use only if you accept that storage model, restrict the 1Password service account to the smallest possible vault scope, verify plist permissions, and rotate any credentials previously written by this script.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/inject-gateway-env.sh:40

Finding

Persistent Plaintext Storage of API Credentials in the LaunchAgent Plist

Content

View full analysis

Vulnerability Details

File Location: scripts/inject-gateway-env.sh:40-54
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: High

Vulnerable Code

bash

inject_key() {
    local key="$1" val="$2"
    [ -z "$val" ] && return
    $BUDDY -c "Delete :EnvironmentVariables:$key" "$PLIST" 2>/dev/null || true
    $BUDDY -c "Add :EnvironmentVariables:$key string $val" "$PLIST"
    echo "  ✅ $key"
}

inject_key "OPENAI_API_KEY"       "$OPENAI_API_KEY"
inject_key "ANTHROPIC_API_KEY"    "$ANTHROPIC_API_KEY"
inject_key "GEMINI_API_KEY"       "$GEMINI_API_KEY"
inject_key "MISTRAL_API_KEY"      "$MISTRAL_API_KEY"
inject_key "VOYAGE_API_KEY"       "$VOYAGE_API_KEY"
inject_key "HF_TOKEN"             "$HF_TOKEN"
inject_key "OP_SERVICE_ACCOUNT_TOKEN" "$(cat "$TOKEN_FILE")"
inject_key "SHERPA_ONNX_RUNTIME_DIR" "$HOME/.openclaw/sherpa-onnx/runtime"
inject_key "SHERPA_ONNX_MODEL_DIR"   "$HOME/.openclaw/sherpa-onnx/models/vits-piper-en_US-lessac-high"
inject_key "OTLP_ENDPOINT"           "localhost:4317"

Technical Analysis

PlistBuddy serializes the environment-variable values into ~/Library/LaunchAgents/ai.openclaw.gateway.plist. Consequently, the OpenAI, Anthropic, Gemini, Mistral, Voyage, Hugging Face, and 1Password credentials are stored persistently in plaintext on disk.

This behavior directly contradicts the Skill's claim that it injects credentials “without leaving plaintext keys on disk.” No code verifies or enforces restrictive permissions on the resulting plist. Although restarting an existing LaunchAgent is consistent with the declared gateway-management function, persistent storage of all credentials in its configuration is not a minimum-privilege secret-delivery mechanism.

Attack Path

1. An attacker obtains local execution under the user account, access to the user's files, a readable backup, or a diagnostic archive containing the LaunchAgent plist.

...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place secret values directly in a persistent LaunchAgent plist.
• Use a narrowly scoped runtime secret broker or wrapper that obtains credentials immediately before launching the gateway and does not serialize them into persistent configuration.
• Prefer platform-supported secret storage, such as macOS Keychain, with access controls restricted to the intended executable and user.
• If runtime environment variables remain unavoidable, ensure the persistent plist contains only non-secret configuration and references a protected runtime-loading mechanism.
• Never include the 1Password service-account token in the gateway environment.
• As defense in depth, verify ownership and enforce mode 0600 on any file that can contain sensitive configuration.
• Remove existing secret values from deployed plists and rotate every credential previously written there.
• Correct SKILL.md so its security claims accurately describe the implementation.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/inject-gateway-env.sh:51

Finding

1Password Service-Account Token Granted to the Persistent Gateway Service

Content

View full analysis

Vulnerability Details

File Location: scripts/inject-gateway-env.sh:51
Vulnerability Type: Excessive credential delegation and violation of least privilege
Risk Level: High

Vulnerable Code

bash

inject_key "OP_SERVICE_ACCOUNT_TOKEN" "$(cat "$TOKEN_FILE")"

Technical Analysis

The 1Password service-account token is required by the injection script while executing op read. It is not required by the gateway after the provider credentials have been fetched. Injecting the token into the LaunchAgent therefore delegates 1Password access to a persistent service beyond the needs of the stated task.

This widens the trust boundary from a short-lived administrative script to the gateway process and every component capable of inspecting its environment or plist configuration. The obtainable privileges are determined by the service account's 1Password vault permissions and may extend beyond the six credentials used by this script.

Attack Path

1. An attacker compromises the OpenClaw gateway process, a plugin loaded by it, or another component capable of inspecting its environment.
2. Alternatively, the attacker reads the gateway LaunchAgent plist from disk or from a backup.
3. The attacker extracts OP_SERVICE_ACCOUNT_TOKEN.
4. The attacker supplies the token to the 1Password CLI or API.
5. The attacker enumerates and reads any vault items authorized to the service account.
6. Recovered credentials are used to compromise additional external services.

Impact Assessment

A gateway compromise can escalate into access to the associated 1Password service account. The scope is not limited to the API keys explicitly injected by this script; it includes all vaults and items the service account is permitted to read. The token remains available across gateway restarts because it is stored in persistent LaunchAgent configuration.

Remediation

View remediation

Remediation Suggestions

• Delete the OP_SERVICE_ACCOUNT_TOKEN injection entirely.
• Keep the token scoped to the injector process and unset it immediately after the necessary op read operations.
• Configure the 1Password service account with read access only to the exact items required by this workflow.
• Use separate service accounts for unrelated applications and environments.
• Rotate the existing service-account token after removing it from the plist.
• Audit the relevant 1Password activity history for unexpected access.
• Remove the token from existing LaunchAgent files, backups, logs, and diagnostic bundles where feasible.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/inject-gateway-env.sh:40

Finding

Secret Values Exposed Through PlistBuddy Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/inject-gateway-env.sh:40-46
Vulnerability Type: Sensitive information exposed in command-line arguments
Risk Level: Medium

Vulnerable Code

bash

inject_key() {
    local key="$1" val="$2"
    [ -z "$val" ] && return
    $BUDDY -c "Delete :EnvironmentVariables:$key" "$PLIST" 2>/dev/null || true
    $BUDDY -c "Add :EnvironmentVariables:$key string $val" "$PLIST"
    echo "  ✅ $key"
}

Technical Analysis

Each secret is interpolated into the argument passed to PlistBuddy with -c. While the process is running, the complete command may be visible to local process-inspection or endpoint-monitoring tools. Process-accounting systems, crash diagnostics, or security telemetry may also retain command arguments after execution.

The value is additionally embedded into PlistBuddy's command language rather than supplied through a structured data interface. A secret containing command-parser metacharacters, quotes, or unusual whitespace may be misinterpreted or cause injection to fail. The reviewed code does not validate or safely encode values for this parser.

Attack Path

1. An attacker or monitoring component observes process arguments while the injection script is running.
2. The attacker identifies the PlistBuddy -c processes.
3. The attacker extracts the value following the string portion of each command argument.
4. The recovered API credentials or 1Password token are used against their respective services.

A second failure path exists when a valid credential contains parser-significant characters: the value may be truncated, rejected, or interpreted as part of PlistBuddy's command syntax, resulting in incorrect configuration or unintended plist modification.

Impact Assessment

Exploitation can disclose every credential passed to inject_key, including the high-impact 1Password service-account token. The direct obse ...[truncated 188 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pass secrets as command-line arguments.
• Replace PlistBuddy command-string interpolation with a structured plist API that accepts data without embedding it into a secondary command language.
• Prefer a runtime secret-delivery design that does not write secrets into the plist at all.
• If a plist must be manipulated, use a small trusted program based on Foundation or another structured plist library, with secret input received through a protected channel rather than argv.
• Avoid logging command arguments and review endpoint telemetry retention policies for sensitive process data.
• Rotate credentials if process accounting or monitoring systems may already have captured these commands.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/inject-gateway-env.sh:14

Finding

Token Provisioning Guidance Can Leak the Secret Through Shell History and File-Creation Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/inject-gateway-env.sh:14-17
Vulnerability Type: Unsafe credential provisioning guidance
Risk Level: Medium

Vulnerable Code

bash

if [ ! -f "$TOKEN_FILE" ]; then
    echo "❌ No 1Password token at $TOKEN_FILE"
    echo "   Get it from 1Password and run: echo <TOKEN> > $TOKEN_FILE && chmod 600 $TOKEN_FILE"
    exit 1
fi

Technical Analysis

The displayed guidance encourages users to substitute the actual service-account token directly into an interactive shell command. Depending on shell configuration, that command can be retained in command history.

The file is also created before chmod 600 is applied. Its initial mode is governed by the user's current umask; with a permissive configuration, the file may briefly be readable by unintended local principals. If the follow-up chmod fails or the compound command is interrupted, the weak permissions may persist.

Attack Path

1. A user follows the printed instruction and inserts the real service-account token into the command line.
2. The shell records the command in its history file, or terminal/session auditing captures it.
3. A local attacker or support process reads the retained history or audit data and extracts the token.

Alternatively:

1. The token file is created under a permissive umask.
2. Before chmod 600 completes—or if it fails—another local principal reads the file.
3. The attacker uses the recovered token to access items authorized to the 1Password service account.

Impact Assessment

Exposure grants the attacker the read privileges assigned to the 1Password service account. The resulting scope may include all vault items available to that account, not only the API credentials fetched by this script. History-based exposure can remain discoverable long after initial setup.

Remediation

View remediation

Remediation Suggestions

• Replace the printed command with a secure setup helper that reads the token using a hidden prompt, such as read -r -s.
• Set umask 077 before creating any credential file.
• Create the parent directory with restrictive permissions and verify its ownership.
• Create the token file atomically with mode 0600, rather than creating it first and changing permissions afterward.
• Prevent the token from appearing in command history, process arguments, logs, or terminal output.
• Validate the resulting file with checks for regular-file type, expected owner, and mode 0600 before reading it.
• Advise affected users to remove prior token-bearing commands from shell history and rotate the token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims secrets are injected 'without leaving plaintext keys on disk,' yet writing values into a LaunchAgent plist necessarily persists them in a local file. The mismatch is dangerous because it can mislead users into deploying the skill under false security assumptions while also introducing undeclared secret handling, configuration injection, and service restart side effects.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises shell-based behavior and execution instructions but does not declare an explicit tool scope such as permissions or allowed-tools. That increases the risk of overbroad execution in an agent environment, because consumers cannot clearly constrain what shell capabilities the skill expects or is allowed to use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 11)May include surrounding context.

sh

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 31)May include surrounding context.

sh

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 37)May include surrounding context.

sh

---
name: gateway-env-injector
version: 1.0.0
description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).
metadata:
  {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}}
---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly asserts that plaintext keys are not left on disk, but the stated workflow injects secret values into the plist file's EnvironmentVariables section. This is dangerous because plist files are persistent artifacts that may be readable by local users, backups, EDR tools, or support bundles, exposing credentials contrary to user expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The script is explicitly designed to persist secrets in a LaunchAgent plist, which creates long-lived credential material on disk and in the launchd-managed environment. That persistence increases the blast radius of filesystem access, backups, local compromise, and forensic artifact leakage.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 2)May include surrounding context.

sh

#!/usr/bin/env bash
# inject-gateway-env.sh — Bake API keys from 1Password into the OpenClaw gateway plist.
# Run whenever a key changes, or after a fresh bootstrap.
# 
# Requires: op CLI + ~/.config/openclaw/.op-service-token

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The header claims the approach avoids plaintext keys on disk, but the implementation writes secrets directly into an on-disk LaunchAgent plist. This misleading claim can cause operators to underestimate exposure and deploy the script in environments where disk persistence of credentials is unacceptable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently persists multiple secrets into a LaunchAgent plist and restarts the service, but provides no explicit warning that credentials will be stored on disk and exposed through the process environment. This increases the chance of unsafe operational use, accidental disclosure during support/debugging, and misunderstanding of the threat model.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 11)May include surrounding context.

sh

set -euo pipefail

PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
TOKEN_FILE="$HOME/.config/openclaw/.op-service-token"

if [ ! -f "$TOKEN_FILE" ]; then

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 30)May include surrounding context.

sh

set -euo pipefail

PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
TOKEN_FILE="$HOME/.config/openclaw/.op-service-token"

if [ ! -f "$TOKEN_FILE" ]; then

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 31)May include surrounding context.

sh

set -euo pipefail

PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
TOKEN_FILE="$HOME/.config/openclaw/.op-service-token"

if [ ! -f "$TOKEN_FILE" ]; then

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 36)May include surrounding context.

sh

set -euo pipefail

PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
TOKEN_FILE="$HOME/.config/openclaw/.op-service-token"

if [ ! -f "$TOKEN_FILE" ]; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 16)May include surrounding context.

sh

if [ ! -f "$TOKEN_FILE" ]; then
    echo "❌ No 1Password token at $TOKEN_FILE"
    echo "   Get it from 1Password and run: echo <TOKEN> > $TOKEN_FILE && chmod 600 $TOKEN_FILE"
    exit 1
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

This line deletes any existing environment variable entry in the LaunchAgent plist as part of replacing it, confirming the script modifies launchd-managed persistent configuration. In context with the next line, it participates directly in long-term credential storage and rotation on disk.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 42)May include surrounding context.

sh

inject_key() {
    local key="$1" val="$2"
    [ -z "$val" ] && return
    $BUDDY -c "Delete :EnvironmentVariables:$key" "$PLIST" 2>/dev/null || true
    $BUDDY -c "Add :EnvironmentVariables:$key string $val" "$PLIST"
    echo "  ✅ $key"
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

This line writes arbitrary secret values into the LaunchAgent plist under EnvironmentVariables, persisting plaintext credentials on disk and exposing them to the process environment after restart. In this skill context, that is especially dangerous because the script handles multiple API keys and a secret-management token, making local disclosure highly valuable to an attacker.

Content

Scanner excerpt · scripts/inject-gateway-env.sh (reported line 43)May include surrounding context.

sh

local key="$1" val="$2"
    [ -z "$val" ] && return
    $BUDDY -c "Delete :EnvironmentVariables:$key" "$PLIST" 2>/dev/null || true
    $BUDDY -c "Add :EnvironmentVariables:$key string $val" "$PLIST"
    echo "  ✅ $key"
}

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script reads the 1Password service account token from disk and then injects it into the LaunchAgent plist as an environment variable. That persists a highly privileged secret on disk and exposes it to the gateway process environment, broadening compromise scope from individual model keys to the secret-management credential itself.

Content

No source excerpt is available for this finding.