Security audit

Gateway Keeper

Security checks for vulnerabilities and agentic risk

Overview

This watchdog mostly does what it says, but its installer creates persistent scheduled execution and has unsafe cron/path handling that users should review before installing.

Install only from a trusted, simple path and review the exact crontab entry before enabling it. Expect a user-level cron job to run every 15 minutes and expect HEARTBEAT.md to be modified; remove the cron job with the uninstall script and manually remove the HEARTBEAT.md section if you no longer want the recovery behavior.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.sh:5
Finding: Unescaped Script Path Allows Persistent Cron Command Injection
Content: View full analysis
/dev/null | grep -v "$CRON_MARKER"; echo "$CRON_LINE") | crontab - ``` ### Technical Analysis The installer obtains its directory dynamically and inserts the resulting `CHECK_SCRIPT` path directly into a crontab command without quoting or validating it. Although the shell variable is quoted while constructing `CRON_LINE`, those quotes do not become literal quoting in the generated crontab entry. Cron later passes the command portion to a shell. Consequently, spaces and shell metacharacters in the installation path can change how the command is parsed. Cron also assigns special meaning to percent characters, which can further alter command execution unless correctly escaped. The scheduled task itself is consistent with the Skill's declared watchdog functionality and runs only as the user who invokes `crontab`; therefore, the use of cron is not independently an unauthorized persistence mechanism. The vulnerability is that an attacker-controlled installation path can transform this legitimate recurring task into persistent arbitrary command execution. ### Attack Path 1. An attacker causes the Skill package to be installed or extracted under a directory name containing shell-significant characters, spaces, or cron-special characters. 2. The victim executes `scripts/install.sh`. 3. The installer embeds the unescaped absolute path into `CRON_LINE`. 4. The malformed command is written ...[truncated 912 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A description-behavior mismatch is dangerous because operators may trust the documented purpose while the actual implementation performs something else, such as uninstalling cron configuration instead of providing watchdog functionality. In a reliability or recovery context, that can disable monitoring, create blind spots, and cause users to execute scripts they would not have approved if behavior were accurately described.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs users to run shell and PowerShell installer scripts, including an ExecutionPolicy bypass on Windows, but it declares no tool scope or permissions. This creates a transparency and governance gap: consumers and enforcement layers cannot accurately assess that the skill performs privileged OS-level actions, increasing the chance of unintended command execution or unsafe deployment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description lists triggers such as "watchdog" and "gateway health," which are broad phrases that could appear in ordinary discussion about monitoring rather than an intentional invocation of this specific skill. The file does not provide negative examples or narrower activation constraints to distinguish when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The cron installation establishes periodic execution, which is a persistence mechanism. In the context of an agent skill that also references session recovery, this increases risk because the host will repeatedly invoke a script that could later be changed to perform broader actions, making compromise or misuse longer-lived.
Content: Scanner excerpt · scripts/install.sh (reported line 15)May include surrounding context.
sh
# Install cron job (every 15 minutes) CRON_LINE="*/15 * * * * $CHECK_SCRIPT $CRON_MARKER" (crontab -l 2>/dev/null | grep -v "$CRON_MARKER"; echo "$CRON_LINE") | crontab - echo "Cron job installed (every 15 minutes)" # Append recovery section to HEARTBEAT.md

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script installs a recurring cron job into the current user's crontab without prompting, which creates persistent execution on the host. Persistence mechanisms are security-sensitive because they can continue running after the initial install, consume trust implicitly, and be abused if the referenced script is later modified or replaced.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installer performs an additional side effect beyond watchdog setup by modifying HEARTBEAT.md in the user's workspace. Even though the appended text is not executable code, altering workflow/state documentation can influence later agent or user actions and creates persistence in operational behavior without explicit consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Appending content to HEARTBEAT.md without prior notice modifies user workspace state and may affect future recovery behavior or agent decision-making. Silent changes to operational documents are risky because they are hard to detect, can alter workflows persistently, and may be treated as trusted instructions later.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/uninstall.sh (reported line 4)May include surrounding context.
sh
#!/usr/bin/env bash # Uninstall openclaw-gatewaykeeper cron job CRON_MARKER="# openclaw-openclaw-gatewaykeeper" (crontab -l 2>/dev/null | grep -v "$CRON_MARKER") | crontab - echo "Removed openclaw-gatewaykeeper cron job"