Gateway Auto-Fix

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:39 AM UTC
• Version: 2.0.0

Overview

The skill does what it claims, but it installs persistent automation that can repeatedly change OpenClaw gateway configuration and restart the gateway without per-run approval.

Install only if you intentionally want unattended gateway repair. Prefer reviewing and running the included local scripts directly, pinning installer versions, moving logs to a private user-owned location, and adding safeguards such as retry limits, locking, backoff, and alerting before automatic `doctor --fix` and restart actions.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Warning

• Location: setup.sh:49

Finding

Persistent Command Execution Through a Recurring OpenClaw Cron Job

Content

View full analysis

/dev/null | grep -q "gateway-auto-fix"; then openclaw cron add \ --name "gateway-auto-fix" \ --every "1m" \ --message "Run: $SCRIPT_PATH" \ --no-deliver \ --description "Auto-fix gateway if RPC probe fails" echo "✅ OpenClaw cron job added (every 1 minute)" ``` Equivalent persistent scheduling instructions also appear in `SKILL.md:43-48` and `SKILL.md:139-144`. ### Technical Analysis The setup script registers an OpenClaw cron job that instructs the agent to execute a local shell script every minute. The job persists beyond the installation process and continues running across subsequent sessions. Although the scheduled behavior is disclosed and supports the skill's stated monitoring purpose, it establishes a persistent execution point. The cron entry refers to a mutable file under the user's workspace instead of an immutable or integrity-verified artifact. If that script is subsequently modified, replaced, or made writable by another principal, the cron job will repeatedly execute the replacement content. The setup script also does not verify the resulting file's owner, permissions, or cryptographic integrity before registering the job. ### Attack Path 1. A user runs `setup.sh` or follows the documented manual installation procedure. 2. The installer writes an executable script to `~/.openclaw-it/workspace/openclaw-auto-fix.sh`. 3. The installer registers `gateway-auto-fix` as a recurring OpenClaw cron job. 4. OpenClaw processes the message `Run:

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: openclaw-auto-fix.sh:5

Finding

Predictable Temporary Log Path Permits Symlink-Based File Redirection

Content

View full analysis

> $LOG_FILE ``` The same unsafe log path is embedded in the generated script at `setup.sh:17-19` and in the manual setup example at `SKILL.md:106-108`. ### Technical Analysis The script appends diagnostic data to a fixed, predictable path in the shared `/tmp` directory. Shell redirection follows symbolic links, and the script performs no validation of the destination's type, owner, permissions, or link count. An attacker with local access can attempt to create `/tmp/openclaw-auto-fix.log` before the first script execution and point it to another file. When the scheduled process opens the path with append redirection, output can be redirected into the symlink target. The practical exploitability depends on operating-system symlink protections, target permissions, and the privileges under which OpenClaw runs. On systems where protected-symlink controls block the operation, or where the process cannot write to the target, the attempted redirection will fail. If the process is privileged or the target is writable, the issue can cause unauthorized file modification. The log may also contain gateway diagnostic output and results from `openclaw doctor --fix`, potentially exposing operational details to users who can read the file. ### Attack Path 1. A local attacker determines that `/tmp/openclaw-auto-fix.log` does not yet exist or can otherwise be controlled. 2. The attacker creates that path as a symbolic link to a file writable by the account running the scheduled job. 3. The recurring job invokes `openclaw-auto-fix.sh`. 4. Shell append redirection follows the symbolic link. 5. Dates, gateway status, and command output are appended to the attacker-selected target. 6. Depending on the target file format and pr ...[truncated 706 chars]

Remediation

View remediation

> "$LOG_FILE" ``` - Prefer a system logging API or OpenClaw's native logging mechanism where available. - Configure log rotation and avoid recording secrets or unnecessary diagnostic details. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Package Execution in the Quick-Install Procedure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

openclaw cron rm gateway-auto-fix

Remove script

rm ~/.openclaw-it/workspace/openclaw-auto-fix.sh

text

## Usage

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs users to run shell commands, create executable scripts, and register a recurring cron job, yet it declares no tool scope or permissions metadata. This weakens transparency and policy enforcement, making it easier for an agent or user to invoke broad shell capabilities without explicit review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description presents the skill as a simple monitoring aid but does not prominently warn that it will automatically modify configuration and restart the gateway every minute when a probe fails. This omission can mislead users about the operational risk and can cause unintended service disruption or state changes after installation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The skill performs autonomous decision-making by parsing service status and automatically invoking repair and restart actions without human approval. In this context, false positives, transient failures, or manipulated status output could trigger repeated disruptive actions and configuration changes.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

1. Checks `openclaw gateway status` every minute
2. Detects "RPC probe: failed" in the output
3. Automatically runs:
   - `openclaw doctor --fix` to fix config issues
   - `openclaw gateway restart` to restart the gateway
4. Logs all actions to `/tmp/openclaw-auto-fix.log`

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clawhub install gateway-auto-fix without pinning a version allows the fetched package or installer behavior to change over time, including supply-chain compromise or malicious updates. Because installation leads to persistent automation and shell execution, an unexpected package version could gain recurring execution on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill establishes session persistence by installing a script into the user's workspace and registering a cron job that runs every minute. Persistent autonomous execution increases the blast radius of mistakes or compromise, because the behavior continues after the initial install and may repeatedly alter system state.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

That's it! The skill will:
- ✅ Add OpenClaw cron job (every 1 minute)
- ✅ Create the script
- ✅ Start monitoring

## Manual Install (If ClawHub Not Available)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script installs a persistent job that runs every minute and automatically executes openclaw doctor --fix and openclaw gateway restart based on parsed command output, without user confirmation, approval gates, or safeguards. In a privileged operational context, this can cause repeated unintended configuration changes, service disruption, or masking of underlying issues, especially if the status check is noisy or manipulated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.