ClawHub
Back to skill

Security audit

Clawdoctor

Security checks for vulnerabilities and agentic risk

Overview

ClawDoctor is a real OpenClaw monitoring and self-healing tool, but its Telegram approval path can trigger disruptive admin actions without verifying who pressed the button.

Review before installing on production OpenClaw systems. Start with `clawdoctor start --dry-run`, keep Telegram approvals in a private/admin-only chat, avoid enabling callback buttons for shared groups until sender/chat authorization is fixed, and understand that Heal-tier operation can restart services, disable or run crons, refresh auth, and kill sessions. License activation sends the key to clawdoctor.dev, and systemd persistence should only be enabled intentionally.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/alerters/telegram.ts:228
Finding

Telegram approval callbacks do not authenticate the requesting user or chat

Content
View full analysis
; }; if (!data.ok || !data.result?.length) return; for (const update of data.result) { this.lastUpdateId = Math.max(this.lastUpdateId, update.update_id); const cbq = update.callback_query; if (!cbq?.data) continue; const pending = this.pendingCallbacks.get(cbq.data); if (!pending) continue; // Answer the callback query to remove loading state try { await fetch(`${TELEGRAM_API}/bot${telegram.callbackBotToken}/answerCallbackQuery`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ callback_query_id: cbq.id, text: 'Processing...' }), }); } catch { /* ignore */ } // Remove handler and execute this.pendingCallbacks.delete(cbq.data); console.log(`[${nowIso()}] [TelegramAlerter] Callback received: ${cbq.data}`); pending.handler().catch(err => { console.error(`[TelegramAlerter] Callback handler erro ...[truncated 5737 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior understates the tool's real authority: the analysis indicates license enforcement, remote Telegram-triggered actions, disabling crons, killing sessions, and broader budget-healing operations beyond simple monitoring and gateway restart. When operationally destructive or remote-controlled features are omitted, users cannot accurately assess risk, and the skill can be deployed with far more privilege and effect than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents automatic healing actions such as gateway restart, cron retry, session kill, snapshots, and rollback, but does not include a direct caution that these operations can alter running services or terminate sessions. Under the markdown-specific warning rule, behaviors affecting system integrity or user data should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CLAWDOCTOR-FACTSHEET.md (reported line 191)May include surrounding context.

md
- License activation and tier enforcement
- Config snapshots + rollback
- Audit trail (JSONL)
- Systemd service installation
- Non-interactive init with `--telegram-token` flag (fixed in this audit)

### Listed on landing page as "Coming in v2" but already built

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The document explicitly states there is no rate limiting on public API endpoints, including license-related routes backed by Stripe queries. Even if key brute force is impractical, unauthenticated high-volume requests can amplify backend cost, exhaust API quotas, and degrade service availability, making this a real resource-abuse weakness.

Content

Scanner excerpt · CLAWDOCTOR-FACTSHEET.md (reported line 316)May include surrounding context.

md
6. **No webhook idempotency** - Stripe webhook retries generate duplicate license keys (unfixed, site is root-owned).

7. **No rate limiting on API endpoints** - could cause Stripe API cost abuse in theory.

8. **CLAWDOCTOR_KEY env var always yields diagnose plan** - loadLicense() hardcodes `plan: 'diagnose'` for env var keys, even if the actual subscription is heal tier. User must run `clawdoctor activate` to get correct plan detection.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest positions the skill as a local self-healing monitor, and the fact sheet itself documents external backend dependencies for license validation and checkout handling. Saying there is 'No server, no database, no SaaS' contradicts the actual described operations because a remote service is part of the product's functioning.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This is an active contradiction within the documentation: the backend section explicitly lists API routes, Stripe webhook handling, and remote license validation, while the differentiators section denies any server/SaaS component. That is more than an omission; it directly misstates how the product operates.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CLAWDOCTOR-FACTSHEET.md (reported line 174)May include surrounding context.

bash
clawdoctor install-service
systemctl --user daemon-reload
systemctl --user enable clawdoctor
systemctl --user start clawdoctor

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 123)May include surrounding context.

bash
clawdoctor install-service
systemctl --user daemon-reload
systemctl --user enable clawdoctor
systemctl --user start clawdoctor

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · src/index.ts (reported line 349)May include surrounding context.

ts
```bash
clawdoctor install-service
systemctl --user daemon-reload
systemctl --user enable clawdoctor
systemctl --user start clawdoctor
```

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README documents a fully non-interactive setup using --auto-fix --no-prompt but does not clearly warn that healers can perform disruptive actions such as restarting the gateway or killing stuck sessions. In an operations-focused tool, users often copy-paste quick-start commands directly; omitting an explicit caution increases the chance of unintended destructive changes or service interruption.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises installation and operation of a networked monitoring daemon that uses environment/config data and sends Telegram alerts, but it does not declare any explicit tool scope or permissions. This weakens user and platform visibility into sensitive capabilities, making it easier for the skill to access local state and communicate externally without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The installation/description text does not clearly warn that the tool can automatically restart services and otherwise modify system state. In a monitoring context, operators may reasonably expect observability rather than autonomous remediation, so the missing warning increases the chance of unintended service disruption or unauthorized changes on production systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The quick-start flow instructs users to run the daemon immediately without warning that it may send outbound Telegram alerts and perform healing actions. This can lead to accidental external data disclosure, noisy alerting, and automatic operational changes before the user has reviewed configuration, scope, or dry-run behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The task explicitly collects a Telegram bot token and stores it in a local JSON config, but does not require secure storage, restrictive file permissions, or any warning to the user that a long-lived secret will be written to disk. If the home directory is backed up, shared, inspected by another local user, or the file is accidentally exposed, the bot token can be abused to read/send bot messages and potentially impersonate operational alerts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · TASK.md (reported line 33)May include surrounding context.

md
2. Verify gateway is installed (`which openclaw`)
3. Ask for Telegram bot token + chat ID for alerts
4. Ask for alert preferences (what to monitor, auto-fix on/off)
5. Write config to `~/.agentwatch/config.json`
6. Create SQLite DB at `~/.agentwatch/events.db`
7. Offer to install systemd service

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The design includes automatic execution of restart commands against the OpenClaw gateway, which is a system-modifying action that can disrupt running workloads or be triggered repeatedly under faulty detection conditions. Without an explicit consent/warning flow and safety guardrails, users may enable behavior that changes process state unexpectedly and could worsen outages or create denial-of-service conditions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends alert contents, including the monitor name, event message, timestamp, chat ID, and host information, to the Telegram API via HTTP. While the network action is implemented clearly, there is no user-facing disclosure here such as a prompt, warning comment/docstring, or other notice that system data will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The callback flow performs network requests to Telegram using a dedicated callback bot token and exchanges callback query data with the external service. Although logging exists for failures, there is no user-facing warning in this file explaining that callback interactions and bot credentials are used with Telegram.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code sends the user's license key to a remote server at clawdoctor.dev for validation, but this file contains no user-facing notice, consent flow, or configuration gate around that transmission. Even though it uses HTTPS, a license key is still a sensitive credential-like token, and silent exfiltration to a third party creates privacy, compliance, and trust risks if users are unaware or if the service is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The killAllSessions method performs an irreversible bulk destructive action by iterating all agents and killing every discovered session with no confirmation, no allowlist for 'essential' sessions, and no authorization check at the execution point. Although the heal() path requests approval, this function itself can be invoked directly or from another code path, so the safety guarantee is not enforced where the destructive action actually occurs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · src/healers/process.ts (reported line 30)May include surrounding context.

ts
);

    // Try systemctl first
    const systemctlStatus = runShell('systemctl is-enabled openclaw-gateway 2>/dev/null');
    if (systemctlStatus.ok && systemctlStatus.stdout.trim() === 'enabled') {
      const restartResult = runShell('systemctl restart openclaw-gateway');
      if (restartResult.ok) {

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · src/index.ts (reported line 163)May include surrounding context.

ts
if (!nonInteractive) {
      console.log('\n💡 To start monitoring now, run: clawdoctor start');
      console.log('💡 To install as a systemd service, run: clawdoctor install-service');
      console.log('');
    }
  });

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a monitoring and self-healing tool for OpenClaw gateways, crons, sessions, alerts, and token costs. This file also implements remote license-key validation, local license storage, plan/feature display, and upgrade prompting, which are business/account capabilities rather than an obvious implementation detail of operational monitoring.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

A monitor for OpenClaw health is expected to inspect local state, restart services, and send alerts, but not to process product license keys or contact remote validation services for billing/entitlement checks. Reading CLAWDOCTOR_KEY and validating it remotely introduces account/credential-handling behavior outside the declared purpose.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
src/snapshots.ts:92

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
src/utils.ts:18