Gateway Keeper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:06 AM UTC
• Version: 2.0.0

Overview

This watchdog mostly does what it says, but its installer creates persistent scheduled execution and has unsafe cron/path handling that users should review before installing.

Install only from a trusted, simple path and review the exact crontab entry before enabling it. Expect a user-level cron job to run every 15 minutes and expect HEARTBEAT.md to be modified; remove the cron job with the uninstall script and manually remove the HEARTBEAT.md section if you no longer want the recovery behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install.sh:5
• Finding: Unescaped Script Path Allows Persistent Cron Command Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh`, lines 5–15 **Vulnerability Type**: Cron command injection through an unescaped installation path **Risk Level**: Medium ### Vulnerable Code ```bash SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" CHECK_SCRIPT="$SCRIPT_DIR/check-gateway.sh" WORKSPACE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}" HEARTBEAT="$WORKSPACE/HEARTBEAT.md" CRON_MARKER="# openclaw-openclaw-gatewaykeeper" chmod +x "$CHECK_SCRIPT" # Install cron job (every 15 minutes) CRON_LINE="*/15 * * * * $CHECK_SCRIPT $CRON_MARKER" (crontab -l 2>/dev/null | grep -v "$CRON_MARKER"; echo "$CRON_LINE") | crontab - ``` ### Technical Analysis The installer obtains its directory dynamically and inserts the resulting `CHECK_SCRIPT` path directly into a crontab command without quoting or validating it. Although the shell variable is quoted while constructing `CRON_LINE`, those quotes do not become literal quoting in the generated crontab entry. Cron later passes the command portion to a shell. Consequently, spaces and shell metacharacters in the installation path can change how the command is parsed. Cron also assigns special meaning to percent characters, which can further alter command execution unless correctly escaped. The scheduled task itself is consistent with the Skill's declared watchdog functionality and runs only as the user who invokes `crontab`; therefore, the use of cron is not independently an unauthorized persistence mechanism. The vulnerability is that an attacker-controlled installation path can transform this legitimate recurring task into persistent arbitrary command execution. ### Attack Path 1. An attacker causes the Skill package to be installed or extracted under a directory name containing shell-significant characters, spaces, or cron-special characters. 2. The victim executes `scripts/install.sh`. 3. The installer embeds the unescaped absolute path into `CRON_LINE`. 4. The malformed command is written ...[truncated 912 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Install or copy the health-check script to a fixed, trusted location with a predictable path rather than scheduling execution directly from an arbitrary package directory. 2. Reject paths containing line breaks, carriage returns, control characters, percent characters, or other values unsafe in crontab records. 3. Generate the command using a robust shell-quoting routine compatible with the shell used by cron. Account separately for cron's special handling of `%`; ordinary shell quoting alone is insufficient. 4. Prefer a fixed wrapper script whose path contains only a conservative character set, such as letters, digits, `/`, `_`, `.`, and `-`. 5. Write the generated crontab to a temporary file, validate the complete entry, and then install it only after validation succeeds. 6. Document that the installer must not be run as root unless system-wide watchdog operation is explicitly required. 7. Preserve the existing marker-based uninstall behavior, but use exact matching to avoid deleting unrelated user crontab entries that happen to contain the same marker text. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A description-behavior mismatch is dangerous because operators may trust the documented purpose while the actual implementation performs something else, such as uninstalling cron configuration instead of providing watchdog functionality. In a reliability or recovery context, that can disable monitoring, create blind spots, and cause users to execute scripts they would not have approved if behavior were accurately described.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill instructs users to run shell and PowerShell installer scripts, including an ExecutionPolicy bypass on Windows, but it declares no tool scope or permissions. This creates a transparency and governance gap: consumers and enforcement layers cannot accurately assess that the skill performs privileged OS-level actions, increasing the chance of unintended command execution or unsafe deployment.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest description lists triggers such as "watchdog" and "gateway health," which are broad phrases that could appear in ordinary discussion about monitoring rather than an intentional invocation of this specific skill. The file does not provide negative examples or narrower activation constraints to distinguish when the skill should or should not activate.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Install cron job (every 15 minutes)
CRON_LINE="*/15 * * * * $CHECK_SCRIPT $CRON_MARKER"
(crontab -l 2>/dev/null | grep -v "$CRON_MARKER"; echo "$CRON_LINE") | crontab -
echo "Cron job installed (every 15 minutes)"

# Append recovery section to HEARTBEAT.md

• Confidence: 85% confidence
• Finding: The cron installation establishes periodic execution, which is a persistence mechanism. In the context of an agent skill that also references session recovery, this increases risk because the host will repeatedly invoke a script that could later be changed to perform broader actions, making compromise or misuse longer-lived.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script installs a recurring cron job into the current user's crontab without prompting, which creates persistent execution on the host. Persistence mechanisms are security-sensitive because they can continue running after the initial install, consume trust implicitly, and be abused if the referenced script is later modified or replaced.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The installer performs an additional side effect beyond watchdog setup by modifying HEARTBEAT.md in the user's workspace. Even though the appended text is not executable code, altering workflow/state documentation can influence later agent or user actions and creates persistence in operational behavior without explicit consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Appending content to HEARTBEAT.md without prior notice modifies user workspace state and may affect future recovery behavior or agent decision-making. Silent changes to operational documents are risky because they are hard to detect, can alter workflows persistently, and may be treated as trusted instructions later.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env bash
# Uninstall openclaw-gatewaykeeper cron job
CRON_MARKER="# openclaw-openclaw-gatewaykeeper"
(crontab -l 2>/dev/null | grep -v "$CRON_MARKER") | crontab -
echo "Removed openclaw-gatewaykeeper cron job"

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.