OpenClaw Gateway Manager

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.0.2

Overview

This appears to be a real OpenClaw gateway manager, but creating a new gateway can install an auto-starting background service using loosely validated user input.

Install only if you are comfortable with a skill that can edit OpenClaw configuration, scan local ports, restart gateways, create auto-starting user LaunchAgents, and delete instance directories after confirmation. Use simple trusted instance names and numeric ports only, manually back up important OpenClaw data first, and review or remove any created LaunchAgent and backup directories when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script warns that it will delete all session history, memory files, and browser-related data, but the implementation only removes the selected config directory and leaves browser cleanup unimplemented. This creates a dangerous mismatch between user expectations and actual behavior, which can leave sensitive data behind after a supposedly destructive cleanup.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The script tells users backups are recoverable for 7 days, but there is no retention enforcement or cleanup mechanism. As a result, deleted instance data may persist indefinitely, increasing exposure of sensitive configuration, memory, and session data contrary to the script's stated lifecycle.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script creates and immediately loads a macOS LaunchAgent that runs at login with KeepAlive enabled, but it does not present an explicit warning or confirmation that it is installing persistent auto-start behavior. In a skill or automation context, silently establishing persistence can surprise users and increases risk because the service will continue restarting and running beyond the current session.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "ℹ️  Node 路径：$NODE_PATH"

# 6. 创建 LaunchAgent plist（使用动态路径）
cat > "$PLIST_FILE" << PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 91% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "ℹ️  Node 路径：$NODE_PATH"

# 6. 创建 LaunchAgent plist（使用动态路径）
cat > "$PLIST_FILE" << PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 91% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>
</plist>
PLISTEOF
echo "✅ LaunchAgent 已创建：$PLIST_FILE"

# 7. 加载并启动
launchctl load "$PLIST_FILE"

• Confidence: 94% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✅ LaunchAgent 已创建：$PLIST_FILE"

# 7. 加载并启动
launchctl load "$PLIST_FILE"
sleep 3
echo "✅ 网关已启动"

• Confidence: 93% confidence
• Finding: launchctl load

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✅ LaunchAgent 已创建：$PLIST_FILE"

# 7. 加载并启动
launchctl load "$PLIST_FILE"
sleep 3
echo "✅ 网关已启动"

• Confidence: 93% confidence
• Finding: PLIST

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/gateway-create.sh:87