ClawHub
Back to skill

Security audit

金刚罩

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its OpenClaw maintenance purpose, but it can copy or log secrets and automatically delete files, so it needs review before installation.

Install only if you are comfortable with a maintenance skill that can restart OpenClaw, back up .env and LaunchAgent files, write persistent config audit data, and delete old sessions, backups, logs, and matching temp files. Prefer environment-variable secrets over inline secrets, restrict permissions on ~/.openclaw/backups and ~/.openclaw/data/system-guardian, review config-audit.log for secret exposure, and avoid the unpinned git-clone install path unless you verify the exact commit.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/safe-restart.sh:32
Finding

Configuration validation relies on ambiguous substring matching

Content
View full analysis
&1 | grep -q "valid"; then ok "配置校验通过" else fail "配置校验失败！中止重启。" openclaw config validate 2>&1 exit 1 fi ``` The same pattern is used by the configuration guard: ```bash info "运行 openclaw config validate..." if openclaw config validate 2>&1 | grep -q "valid"; then ok "OpenClaw 配置校验通过" else fail "OpenClaw 配置校验失败" openclaw config validate 2>&1 ERRORS=$((ERRORS + 1)) fi ``` ### Technical Analysis The scripts determine whether validation succeeded by searching the command's combined output for the unanchored substring `valid`. This token is also contained in words such as `invalid` and can occur in unrelated warnings or diagnostic output. Both scripts enable `pipefail`, which preserves a nonzero exit status from `openclaw` in ordinary failure cases. Consequently, exploitation requires the validator or an extension influencing its output to return zero while printing an error or ambiguous message containing `valid`. The output test nevertheless creates an unnecessary and fragile secondary success condition instead of treating the validator's documented exit status as authoritative. The scripts also invoke validation twice on failure. If validation has side effects or its result changes between executions, the displayed diagnostic may not correspond to the result used by the first check. ### Attack Path 1. A malformed or semantically unacceptable configuration is supplied to OpenClaw. 2. The validation command, or a plugin participating in validation, returns exit status zero while emitting text such as `invalid configuration` or another message containing `valid`. 3. `grep -q "valid" ...[truncated 623 chars]
Remediation
View remediation
&1); then printf '%s\n' "$VALIDATION_OUTPUT" ok "Configuration validation passed" else printf '%s\n' "$VALIDATION_OUTPUT" >&2 fail "Configuration validation failed; restart aborted" exit 1 fi ``` Apply the same change to `scripts/config-guard.sh`. If a textual success marker is required by the OpenClaw interface, match a documented, anchored, machine-readable token rather than the substring `valid`. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/health-patrol.sh:228
Finding

Inline configuration secrets may be copied into insufficiently protected audit artifacts

Content
View full analysis
/dev/null || md5sum "$CONFIG" 2>/dev/null | awk '{print $1}') if [ -f "$CONFIG_HASH_FILE" ]; then PREV_HASH=$(cat "$CONFIG_HASH_FILE") if [ "$CURRENT_HASH" != "$PREV_HASH" ]; then warn "openclaw.json 自上次巡检后已变更" WARNINGS=$((WARNINGS + 1)) # Log the change echo "[$(date '+%Y-%m-%d %H:%M:%S')] CONFIG CHANGED: hash ${PREV_HASH} → ${CURRENT_HASH}" >> "$AUDIT_LOG" # Save a snapshot for diff if [ -f "${GUARDIAN_DATA}/.config-snapshot.json" ]; then DIFF_LINES=$(diff "${GUARDIAN_DATA}/.config-snapshot.json" "$CONFIG" 2>/dev/null | head -20) if [ -n "$DIFF_LINES" ]; then echo "[$(date '+%Y-%m-%d %H:%M:%S')] DIFF:" >> "$AUDIT_LOG" echo "$DIFF_LINES" >> "$AUDIT_LOG" fi fi cp "$CONFIG" "${GUARDIAN_DATA}/.config-snapshot.json" else ok "openclaw.json 未变更" fi else info "首次记录配置 hash" cp "$CONFIG" "${GUARDIAN_DATA}/.config-snapshot.json" fi echo "$CURRENT_HASH" > "$CONFIG_HASH_FILE" ``` ### Technical Analysis The project documentation explicitly supports storing credentials directly in `openclaw.json`. The health patrol copies the complete configuration into `.config-snapshot.json` and writes raw diff content to `config-audit.log`. The script does not establish a restrictive `umask`, does not explicitly set file modes, and does not redact sensitive JSON fields. Newly created files therefore inherit permissions from the invoking environment. Under a permissive umask, configuration snapshots and audit logs can be readable by other loca ...[truncated 1304 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/health-patrol.sh:254
Finding

Health cleanup can delete unrelated files from the global temporary directory

Content
View full analysis
/dev/null | wc -l | tr -d ' ') if [ "$TMP_COUNT" -gt 10 ]; then warn "临时文件 ${TMP_COUNT} 个，清理中..." find /tmp -maxdepth 1 -name "token-ledger-*" -mtime +${TMP_MAX_AGE_DAYS} -delete 2>/dev/null || true find /tmp -maxdepth 1 -name "morning-ledger*" -mtime +${TMP_MAX_AGE_DAYS} -delete 2>/dev/null || true find /tmp -maxdepth 1 -name "yt_*" -mtime +${TMP_MAX_AGE_DAYS} -delete 2>/dev/null || true ok "已清理过期临时文件" else ok "临时文件 ${TMP_COUNT} 个" fi ``` ### Technical Analysis The cleanup searches the shared `/tmp` namespace using broad filename patterns. In particular, `yt_*` is not tied to an OpenClaw-specific private directory, ownership marker, or manifest of files created by this project. Deletion is triggered when the combined number of files matching any of four patterns exceeds ten. Files counted under one pattern can therefore activate deletion of unrelated old files matching another pattern. The deletion commands suppress errors and report success even when files could not be removed. Although `find` uses `-maxdepth 1`, which limits traversal, the code still deletes any matching top-level object that the invoking user is permitted to delete. It does not verify creator identity, ownership, file type, or whether another process is using the file. ### Attack Path 1. Another application or the same user creates legitimate temporary files named `/tmp/yt_*`. 2. Those files become older than `TMP_MAX_AGE_DAYS`. 3. At least eleven files matching the combined temporary-file patterns exist. 4. The health patrol runs with the user's permissions. 5. The broad `find /tmp ... -name "yt_*" ... -delete` operation re ...[truncated 619 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:128
Finding

Installation instructions execute content from an unpinned mutable repository

Content
View full analysis
Remediation
View remediation
``` For stronger assurance: 1. Publish signed release tags and require signature verification. 2. Publish SHA-256 checksums for release archives. 3. Document the exact reviewed version and commit identifier. 4. Prefer immutable release archives over cloning a mutable default branch. 5. Protect the upstream repository with multi-factor authentication, branch protection, mandatory review, and restricted release permissions. 6. Advise users to verify the signature or checksum before executing any script. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (46)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code only implements pre-validation and basic health/resource checks related to configuration safety: syntax validation, required fields, env references, port usage, and disk space. It does not perform automatic backups, restore or rollback changes on failure, optimize resources, or carry out any self-healing/remediation actions. The declared description presents a broader system-guardian capability set than the supplied code actually delivers. The primary purpose is partially aligned on configuration safety and health inspection, but several headline capabilities are not implemented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

描述与代码部分重合于“健康巡检”和一定程度的“资源优化”，但存在明显落差。该脚本主要是巡检+审计+清理：它会读取 OpenClaw 目录、配置、备份、cron、插件状态，并删除旧 session、过量备份、临时文件和旧日志，还会写入审计日志和 baseline.csv。相比之下，声明重点提到的“配置安全（pre-validate + 自动备份 + 失败回滚）”在此代码中并未实现：没有配置预校验逻辑，没有在变更前自动备份配置，也没有失败时回滚配置。所谓“故障自愈”也基本未体现，除了有限的清理动作外，并不会重启 gateway、修复 cron、恢复配置或处理严重故障。因此其实际主功能更像‘健康巡检/审计/清理’而非完整的‘系统守护与配置安全防护’。此外，自动删除文件属于具有副作用的能力，描述中仅笼统提到资源优化，未明确说明会清理和删除历史数据，因此可视为未充分声明的能力。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The code substantially matches the 'configuration safety' part of the description: it pre-validates configuration, creates backups, restarts the service, performs a post-restart health check, and rolls back on failure. However, the declared description is broader and somewhat different in scope. The script's concrete primary behavior is a safe restart procedure for the OpenClaw Gateway, including direct service control and LaunchAgent plist backup/restore, which are not explicitly declared. More importantly, the description claims additional capabilities like resource optimization and broader health inspection/self-healing that are not present in this code chunk. Because the implemented behavior is narrower in some claimed areas but also includes undeclared service-restart/system-management actions, this is best classified as a mismatch rather than a fully accurate description.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config-guard.sh (reported line 8)May include surrounding context.

sh
OPENCLAW_DIR="${HOME}/.openclaw"
CONFIG="${OPENCLAW_DIR}/openclaw.json"
ENV_FILE="${OPENCLAW_DIR}/.env"

RED='\033[0;31m'
GREEN='\033[0;32m'

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 39)May include surrounding context.

sh
OPENCLAW_DIR="${HOME}/.openclaw"
CONFIG="${OPENCLAW_DIR}/openclaw.json"
ENV_FILE="${OPENCLAW_DIR}/.env"

RED='\033[0;31m'
GREEN='\033[0;32m'

Chaining Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The pipeline 'ls ... | tail ... | xargs rm -f' is brittle and unsafe for file deletion because it relies on whitespace-delimited parsing and unguarded command chaining. Filenames containing spaces, newlines, or leading dashes can be mishandled, causing unintended deletions; because this removes backups, mistakes directly impact recoverability.

Content

Scanner excerpt · scripts/health-patrol.sh (reported line 284)May include surrounding context.

sh
BAK_N=$(ls -1 "$BACKUP_DIR"/$pattern 2>/dev/null | wc -l | tr -d ' ')
        if [ "$BAK_N" -gt "$BACKUP_MAX_COUNT" ]; then
            EXCESS=$((BAK_N - BACKUP_MAX_COUNT))
            ls -1t "$BACKUP_DIR"/$pattern | tail -n "$EXCESS" | xargs rm -f
            ok "清理 $EXCESS 个多余备份 ($pattern)"
            CLEANED=$((CLEANED + EXCESS))
        fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config-guard.sh (reported line 67)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config-guard.sh (reported line 75)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config-guard.sh (reported line 83)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 43)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 52)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 58)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 62)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 65)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 81)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 124)May include surrounding context.

sh
# Detect if config uses ${VAR} references (env-based) or inline values (default)
VAR_REFS=$(grep -oE '\$\{[A-Z_]+\}' "$CONFIG" 2>/dev/null | sort -u | sed 's/\${\(.*\)}/\1/') || true
if [ -n "$VAR_REFS" ]; then
    # Config uses env var references → need .env file
    if [ -f "$ENV_FILE" ]; then
        MISSING_VARS=()
        for var in $VAR_REFS; do

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

Backing up a .env file can duplicate credentials into another location, expanding the number of files containing secrets. If the backup directory permissions are too broad or backups persist too long, secrets may be exposed to other local users or included in later sync/exfiltration events.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 77)May include surrounding context.

sh
cp "$CONFIG" "$BACKUP_FILE"
ok "备份 openclaw.json → $(basename "$BACKUP_FILE")"

# 3b: .env
ENV_BACKUP="${BACKUP_DIR}/env.${TIMESTAMP}.bak"
if [ -f "$ENV_FILE" ]; then
    cp "$ENV_FILE" "$ENV_BACKUP"

Chaining Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Using ls ... | tail ... | xargs rm -f is unsafe because filenames with spaces, tabs, newlines, or leading dashes can be split or interpreted as options, causing unintended deletions. If an attacker can create crafted files in the backup directory, they may influence which paths are removed during cleanup.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 97)May include surrounding context.

sh
BAK_COUNT=$(ls -1 "$BACKUP_DIR"/$pattern 2>/dev/null | wc -l | tr -d ' ')
    if [ "$BAK_COUNT" -gt "$MAX_BACKUPS" ]; then
        EXCESS=$((BAK_COUNT - MAX_BACKUPS))
        ls -1t "$BACKUP_DIR"/$pattern | tail -n "$EXCESS" | xargs rm -f
        log "清理旧备份 ($pattern): 删除 $EXCESS 个"
    fi
done

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation is presented entirely in Chinese, including its core instructions and operational guidance, while nowhere indicating that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

md
|------|------|
| 1. 配置校验 | `openclaw config validate` 语法 + 字段检查 |
| 2. 环境变量检查 | 自动检测 env-based 或 inline 模式，确认变量都有定义 |
| 3. 备份三件套 | `openclaw.json` + `.env` + `LaunchAgent plist` → `~/.openclaw/backups/` |
| 4. 重启 | `openclaw gateway restart` + 等待 15 秒 |
| 5. 健康检查 | 检测 Gateway 是否正常运行 |
| 6. 自动回滚 | 如果启动失败 → 恢复全部备份 → 再次重启 → 再次检查 |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/health-patrol.sh (reported line 280)May include surrounding context.

sh
|------|------|
| 1. 配置校验 | `openclaw config validate` 语法 + 字段检查 |
| 2. 环境变量检查 | 自动检测 env-based 或 inline 模式，确认变量都有定义 |
| 3. 备份三件套 | `openclaw.json` + `.env` + `LaunchAgent plist` → `~/.openclaw/backups/` |
| 4. 重启 | `openclaw gateway restart` + 等待 15 秒 |
| 5. 健康检查 | 检测 Gateway 是否正常运行 |
| 6. 自动回滚 | 如果启动失败 → 恢复全部备份 → 再次重启 → 再次检查 |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 84)May include surrounding context.

sh
|------|------|
| 1. 配置校验 | `openclaw config validate` 语法 + 字段检查 |
| 2. 环境变量检查 | 自动检测 env-based 或 inline 模式，确认变量都有定义 |
| 3. 备份三件套 | `openclaw.json` + `.env` + `LaunchAgent plist` → `~/.openclaw/backups/` |
| 4. 重启 | `openclaw gateway restart` + 等待 15 秒 |
| 5. 健康检查 | 检测 Gateway 是否正常运行 |
| 6. 自动回滚 | 如果启动失败 → 恢复全部备份 → 再次重启 → 再次检查 |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 85)May include surrounding context.

sh
|------|------|
| 1. 配置校验 | `openclaw config validate` 语法 + 字段检查 |
| 2. 环境变量检查 | 自动检测 env-based 或 inline 模式，确认变量都有定义 |
| 3. 备份三件套 | `openclaw.json` + `.env` + `LaunchAgent plist` → `~/.openclaw/backups/` |
| 4. 重启 | `openclaw gateway restart` + 等待 15 秒 |
| 5. 健康检查 | 检测 Gateway 是否正常运行 |
| 6. 自动回滚 | 如果启动失败 → 恢复全部备份 → 再次重启 → 再次检查 |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 86)May include surrounding context.

sh
|------|------|
| 1. 配置校验 | `openclaw config validate` 语法 + 字段检查 |
| 2. 环境变量检查 | 自动检测 env-based 或 inline 模式，确认变量都有定义 |
| 3. 备份三件套 | `openclaw.json` + `.env` + `LaunchAgent plist` → `~/.openclaw/backups/` |
| 4. 重启 | `openclaw gateway restart` + 等待 15 秒 |
| 5. 健康检查 | 检测 Gateway 是否正常运行 |
| 6. 自动回滚 | 如果启动失败 → 恢复全部备份 → 再次重启 → 再次检查 |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/safe-restart.sh (reported line 89)May include surrounding context.

sh
|------|------|
| 1. 配置校验 | `openclaw config validate` 语法 + 字段检查 |
| 2. 环境变量检查 | 自动检测 env-based 或 inline 模式，确认变量都有定义 |
| 3. 备份三件套 | `openclaw.json` + `.env` + `LaunchAgent plist` → `~/.openclaw/backups/` |
| 4. 重启 | `openclaw gateway restart` + 等待 15 秒 |
| 5. 健康检查 | 检测 Gateway 是否正常运行 |
| 6. 自动回滚 | 如果启动失败 → 恢复全部备份 → 再次重启 → 再次检查 |

Static analysis

No suspicious patterns detected.