Security audit

OpenClaw Gateway Manager

Security checks for vulnerabilities and agentic risk

Overview

This gateway manager largely matches its stated purpose, but unsafe script handling could enable persistent command execution or unintended data loss.

Review this skill carefully before installing. It can modify OpenClaw configuration, create auto-start services, restart or stop gateway processes, and delete instance directories. Only use trusted instance names and numeric ports, manually inspect generated LaunchAgent files, keep your own backups, and prefer an audited pinned release over the documented default-branch clone.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gateway-create.sh:4
Finding: Persistent Command Injection Through Unvalidated Port Input<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gateway-create.sh:4-5, 33-37, 55-57, 65-108` **Vulnerability Type**: Shell command injection through generated LaunchAgent content **Risk Level**: Critical ### Vulnerable Code ```bash INSTANCE_NAME="$1" PORT="$2" CHANNEL="$3" ``` ```bash # 1. Check whether the port is occupied if lsof -i :$PORT > /dev/null 2>&1; then echo "Port $PORT is already occupied" exit 1 fi ``` ```bash # 4. Modify the port if [ -f "$CONFIG_DIR/openclaw.json" ]; then cat "$CONFIG_DIR/openclaw.json" | jq ".gateway.port = $PORT" > "$CONFIG_DIR/openclaw.json.tmp" && mv "$CONFIG_DIR/openclaw.json.tmp" "$CONFIG_DIR/openclaw.json" fi ``` ```bash # 6. Create LaunchAgent plist cat > "$PLIST_FILE" << PLISTEOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>ai.openclaw.gateway-$INSTANCE_NAME</string> <key>Comment</key> <string>OpenClaw Gateway - $INSTANCE_NAME (port $PORT)</string> <key>RunAtLoad</key> <true/> <key>KeepAlive</key> <true/> <key>ThrottleInterval</key> <integer>1</integer> <key>Umask</key> <integer>63</integer> <key>ProgramArguments</key> <array> <string>$NODE_PATH</string> <string>-e</string> <string>require('child_process').execSync('openclaw gateway --port $PORT', {cwd: '$CONFIG_DIR', stdio: 'inherit', env: {...process.env, OPENCLAW_HOME: '$CONFIG_DIR'}})</string> </array> <key>StandardOutPath</key> <string>$CONFIG_DIR/logs/gateway.log</string> <key>StandardErrorPath</key> <string>$CONFIG_DIR/logs/gateway.err.log</string> <key>EnvironmentVariables</key> <dict> <key>HOME</key> <string>$HOME</string> <key>OPENCLAW_HOME</key> <string>$CONFIG_DIR</string> <key>OPENCLAW_GATEWAY_PORT</key> <string>$PORT</string> ...[truncated 2287 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the port before any use: ```bash if ! [[ "$PORT" =~ ^[0-9]+$ ]] || (( PORT < 1 || PORT > 65535 )); then echo "Invalid port: expected an integer from 1 to 65535" >&2 exit 1 fi ``` 2. Restrict instance names to a conservative allowlist: ```bash if ! [[ "$INSTANCE_NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Invalid instance name" >&2 exit 1 fi ``` 3. Do not invoke OpenClaw through Node `execSync()` or another shell. Put the executable and each argument into separate `ProgramArguments` entries: ```xml <key>ProgramArguments</key> <array> <string>/absolute/path/to/openclaw</string> <string>gateway</string> <string>--port</string> <string>18899</string> </array> ``` 4. Resolve the absolute path of the real `openclaw` executable and reject unexpected or writable replacements. 5. Generate plist files with an XML-aware mechanism rather than unescaped heredoc interpolation. 6. Validate the plist with `plutil -lint` before loading it. 7. Make auto-start an explicit opt-in operation. Creation should not silently imply persistent startup unless the user specifically requests it. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gateway-delete.sh:39
Finding: Path Traversal and Unsafe Recursive Deletion Through Instance Name<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gateway-delete.sh:39-62, 117-126` **Vulnerability Type**: Path traversal leading to recursive deletion outside the intended instance namespace **Risk Level**: High ### Vulnerable Code ```bash # Resolve instance name case "$INSTANCE" in local-shrimp|本地虾 |18789) CONFIG_DIR="$HOME/.jvs/.openclaw" PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist" PORT="18789" ;; feishu|飞书|18790) CONFIG_DIR="$HOME/.openclaw" PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-feishu.plist" PORT="18790" ;; *) # Custom instance CONFIG_DIR="$HOME/.openclaw-$INSTANCE" PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$INSTANCE.plist" PORT="Unknown" ;; esac # Check whether configuration exists if [ ! -d "$CONFIG_DIR" ]; then echo "Configuration directory does not exist: $CONFIG_DIR" exit 1 fi ``` ```bash # 3. Back up configuration BACKUP_DIR="$HOME/.openclaw-deleted-backups/$INSTANCE-$(date +%Y%m%d%H%M%S)" mkdir -p "$BACKUP_DIR" cp -r "$CONFIG_DIR" "$BACKUP_DIR/" 2>/dev/null # 4. Delete configuration directory echo "Deleting configuration directory: $CONFIG_DIR" rm -rf "$CONFIG_DIR" ``` ### Technical Analysis For custom instances, the script directly appends the attacker-controlled instance name to `$HOME/.openclaw-`. It does not reject path separators, `..` components, control characters, or symbolic-link-based path redirection. Quoting `"$CONFIG_DIR"` prevents shell word splitting but does not prevent filesystem traversal. A crafted instance name can cause the computed path to resolve outside the intended custom-instance namespace when a suitable traversable directory or symbolic-link hierarchy exists. The script checks only whether the resulting path is a directory. It does not canonicalize the path or confirm that the resolved target remains an immediate child ...[truncated 1510 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only simple custom-instance identifiers: ```bash if ! [[ "$INSTANCE" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Invalid instance name" >&2 exit 1 fi ``` 2. Explicitly reject `/`, `\`, `..`, leading dots, control characters, and empty names. 3. Canonicalize both the expected parent and deletion target before deletion. Confirm that: - the target is not `$HOME`, `/`, or an empty path; - the target is an immediate child of the approved parent; - its basename begins with `.openclaw-`; - it is not a symbolic link; - its canonical path remains under `$HOME`. 4. Add a defensive deletion guard: ```bash case "$CONFIG_DIR" in "$HOME"/.openclaw-[A-Za-z0-9_-]*) ;; *) echo "Refusing unsafe deletion target: $CONFIG_DIR" >&2 exit 1 ;; esac ``` The shell pattern should supplement, not replace, canonical-path verification. 5. Apply equivalent validation to `PLIST_FILE` and `BACKUP_DIR`. 6. Display the canonical target and require final confirmation against that exact path. 7. Prefer moving the instance into a quarantine or trash directory before any irreversible removal. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gateway-delete.sh:117
Finding: Configuration Deletion Continues After Backup Failure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gateway-delete.sh:117-126` **Vulnerability Type**: Unchecked backup failure followed by irreversible deletion **Risk Level**: High ### Vulnerable Code ```bash # 3. Back up configuration BACKUP_DIR="$HOME/.openclaw-deleted-backups/$INSTANCE-$(date +%Y%m%d%H%M%S)" mkdir -p "$BACKUP_DIR" echo "Backing up configuration to: $BACKUP_DIR" cp -r "$CONFIG_DIR" "$BACKUP_DIR/" 2>/dev/null echo "Backup completed (recoverable within seven days)" # 4. Delete configuration directory echo "Deleting configuration directory: $CONFIG_DIR" rm -rf "$CONFIG_DIR" echo "Configuration directory deleted" ``` ### Technical Analysis The script suppresses all error output from `cp -r` and does not examine its exit status. It unconditionally reports that the backup completed and immediately executes `rm -rf` against the source. Backup failure may occur because of insufficient disk space, filesystem permission errors, quotas, I/O failures, unreadable source files, interrupted copies, or invalid paths. A partial copy may also leave an incomplete backup while the script proceeds as if all data were recoverable. The documentation and script output claim that the deleted data can be recovered within seven days, but the implementation neither verifies backup integrity nor implements a seven-day retention mechanism. ### Attack Path 1. A gateway instance contains configuration, session, memory, or credential-bearing files. 2. The backup destination becomes unavailable or unwritable, or the filesystem lacks sufficient free space. 3. The user invokes the deletion workflow and passes the confirmation prompts. 4. `cp -r` fails completely or copies only part of the source. 5. Error output is discarded through `2>/dev/null`. 6. The script falsely reports successful backup completion. 7. `rm -rf` deletes the original instance directory. 8. Restoration fails because the backup is missing or incomplete. An attacker with the ability to i ...[truncated 530 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Abort immediately if directory creation or copying fails: ```bash if ! mkdir -p -- "$BACKUP_DIR"; then echo "Unable to create backup directory" >&2 exit 1 fi if ! cp -a -- "$CONFIG_DIR" "$BACKUP_DIR/"; then echo "Backup failed; deletion has been cancelled" >&2 exit 1 fi ``` 2. Enable strict shell behavior where compatible: ```bash set -euo pipefail ``` 3. Do not suppress backup errors. Surface actionable diagnostics to the user. 4. Verify that the expected backup directory exists, is readable, and contains the copied source before deletion. 5. For stronger assurance, compare file counts, sizes, or cryptographic manifests between the source and backup. 6. Check available disk space before starting the copy. 7. Replace immediate `rm -rf` with an atomic move into a quarantine directory. Delete quarantined instances only after a documented retention period. 8. Remove the seven-day recovery claim unless an actual cleanup policy and integrity-checked recovery mechanism are implemented. ]]>

T08 · Insecure Dependencies

Warning

Location: clawhub.json:84
Finding: Installation Instructions Retrieve an Unpinned Mutable Repository State<![CDATA[ ## Vulnerability Details **File Location**: `clawhub.json:84-87` **Vulnerability Type**: Unpinned supply-chain dependency **Risk Level**: Medium ### Vulnerable Code ```json "installation": { "en": "git clone https://github.com/seastaradmin/openclaw-gateway-manager.git ~/.jvs/.openclaw/skills/gateway-manager", "zh": "git clone https://github.com/seastaradmin/openclaw-gateway-manager.git ~/.jvs/.openclaw/skills/gateway-manager" } ``` The same unpinned installation pattern also appears in `SKILL.md:61` and `SKILL.md:250`, as well as `README.en.md:52`. ### Technical Analysis The installation command clones the repository's mutable default branch. It does not select an immutable commit, verify a signed release, or check a cryptographic digest. As a result, the effective code installed by a future user may differ from the artifact that underwent this audit. Repository compromise, account takeover, malicious maintenance, or an accidental upstream change could introduce unsafe executable scripts after review. HTTPS protects the transport connection but does not establish that the retrieved repository state is the exact version that was audited. ### Attack Path 1. The upstream repository's default branch is modified after this audit, whether maliciously or through compromise. 2. A user follows the documented `git clone` installation command. 3. Git retrieves the current default branch rather than the reviewed version. 4. The user or agent invokes the downloaded shell scripts. 5. Newly introduced code executes with the user's permissions and may access OpenClaw configuration, create LaunchAgents, or modify user files. ### Impact Assessment The impact depends on the content introduced upstream. Because this Skill legitimately manages persistent services and sensitive configuration directories, a compromised version could execute arbitrary commands, access user-level secrets, modify gateway configuration, or establish persistent user-level execution ...[truncated 165 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish versioned releases and install an immutable audited version. 2. Pin the repository to a full commit hash: ```bash git clone https://github.com/seastaradmin/openclaw-gateway-manager.git gateway-manager cd gateway-manager git checkout --detach FULL_AUDITED_COMMIT_HASH ``` 3. Prefer signed release archives and document signature verification. 4. Publish SHA-256 checksums through a separate trusted release channel and require checksum verification before installation. 5. Ensure the version in `clawhub.json`, documentation, release tag, and security review all identify the same source revision. 6. Add automated release provenance, such as signed tags or build attestations, and reject installation when verification fails. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (117)

Session Persistence

Medium

Category: Rogue Agent
Content: # Verify config ~/.jvs/.openclaw/skills/gateway-manager/scripts/gateway-verify.sh local-shrimp # Create new instance ~/.jvs/.openclaw/skills/gateway-manager/scripts/gateway-create.sh test-bot 18899 openim # Delete instance (triple confirmation)
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file’s instructional and guidance content is predominantly written in Chinese, with only limited English headings and closing text. Under the policy, forcing a specific language without explicit user choice or documented locale justification is a natural-language policy concern.

Session Persistence

Medium

Category: Rogue Agent
Content: ### ℹ Instruction Scope 指令范围 **审查意见：** > SKILL.md tells the agent to run the included scripts. The scripts read and write user files under $HOME, create and load LaunchAgent plists, run openclaw via Node, scan local ports, and perform rm -rf on instance directories. **回应：** ✅ **这是预期行为** - 作为网关管理器，这些操作是必要的：
Confidence: 89% confidence
Finding: This duplicate finding again captures a cluster of risky capabilities: file writes under $HOME, LaunchAgent persistence, local port scanning, and recursive deletion. In context, the document attempts to justify these actions, but the combination remains dangerous for an agent-operated skill because user confirmation and backups do not eliminate abuse or accidental destructive outcomes.

Session Persistence

Medium

Category: Rogue Agent
Content: ### ℹ Instruction Scope 指令范围 **审查意见：** > SKILL.md tells the agent to run the included scripts. The scripts read and write user files under $HOME, create and load LaunchAgent plists, run openclaw via Node, scan local ports, and perform rm -rf on instance directories. **回应：** ✅ **这是预期行为** - 作为网关管理器，这些操作是必要的：
Confidence: 89% confidence
Finding: This duplicate finding again captures a cluster of risky capabilities: file writes under $HOME, LaunchAgent persistence, local port scanning, and recursive deletion. In context, the document attempts to justify these actions, but the combination remains dangerous for an agent-operated skill because user confirmation and backups do not eliminate abuse or accidental destructive outcomes.

Session Persistence

Medium

Category: Rogue Agent
Content: ### i Instruction Scope 指令范围 **审查意见:** > SKILL.md tells the agent to run the included scripts. The scripts read and write user files under $HOME, create and load LaunchAgent plists, run openclaw via Node, scan local ports, and perform rm -rf on instance directories. **回应:** ✅ **这是预期行为** - 作为网关管理器,这些操作是必要的:
Confidence: 89% confidence
Finding: This duplicate finding again captures a cluster of risky capabilities: file writes under $HOME, LaunchAgent persistence, local port scanning, and recursive deletion. In context, the document attempts to justify these actions, but the combination remains dangerous for an agent-operated skill because user confirmation and backups do not eliminate abuse or accidental destructive outcomes.

Session Persistence

Medium

Category: Rogue Agent
Content: ### ℹ Persistence & Privilege 持久性和权限 **审查意见：** > The scripts create and load LaunchAgent plists (user ~/Library/LaunchAgents) and run Node-based commands persistently via launchd. This is necessary for a manager that auto-starts gateways, but it does grant persistent execution under the user's account. **回应：** ✅ **这是必要功能** - 网关需要开机自启：
Confidence: 90% confidence
Finding: This section acknowledges persistent execution via launchd under the user's account. User-level persistence is still security-relevant because it creates durable execution capability, increases attack surface, and can survive the original user interaction.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **回应：** ✅ **这是必要功能** - 网关需要开机自启： - **macOS**: LaunchAgent (`~/Library/LaunchAgents/`) - 用户级，无需 sudo - **Linux**: systemd user service (`~/.config/systemd/user/`) - 用户级 - **Windows**: 可选，不强制创建服务
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **回应：** ✅ **这是必要功能** - 网关需要开机自启： - **macOS**: LaunchAgent (`~/Library/LaunchAgents/`) - 用户级，无需 sudo - **Linux**: systemd user service (`~/.config/systemd/user/`) - 用户级 - **Windows**: 可选，不强制创建服务
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **回应：** ✅ **这是必要功能** - 网关需要开机自启： - **macOS**: LaunchAgent (`~/Library/LaunchAgents/`) - 用户级，无需 sudo - **Linux**: systemd user service (`~/.config/systemd/user/`) - 用户级 - **Windows**: 可选，不强制创建服务
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **回应：** ✅ **这是必要功能** - 网关需要开机自启： - **macOS**: LaunchAgent (`~/Library/LaunchAgents/`) - 用户级，无需 sudo - **Linux**: systemd user service (`~/.config/systemd/user/`) - 用户级 - **Windows**: 可选，不强制创建服务
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **回应：** ✅ **这是必要功能** - 网关需要开机自启： - **macOS**: LaunchAgent (`~/Library/LaunchAgents/`) - 用户级，无需 sudo - **Linux**: systemd user service (`~/.config/systemd/user/`) - 用户级 - **Windows**: 可选，不强制创建服务
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **回应：** ✅ **这是必要功能** - 网关需要开机自启： - **macOS**: LaunchAgent (`~/Library/LaunchAgents/`) - 用户级，无需 sudo - **Linux**: systemd user service (`~/.config/systemd/user/`) - 用户级 - **Windows**: 可选，不强制创建服务
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

Category: Rogue Agent
Content: ## ✨ 功能 - 🔍 **智能查询** - 自动检测所有 OpenClaw 实例（本地/JVS/QClaw/云端） - ✏️ **修改端口** - 自动修改配置文件 + LaunchAgent plist - 🔄 **重启网关** - 安全重启指定网关或所有网关 - ✅ **验证配置** - 检查配置一致性、端口监听状态 - ➕ **创建新实例** - 一键创建新网关实例
Confidence: 79% confidence
Finding: The feature list states that the skill modifies LaunchAgent plist files, which is a form of persistence management. In this context it is part of the product's purpose, but modifying auto-start definitions still affects session persistence and should be treated as security-sensitive behavior.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Earlier documentation explicitly says macOS is required and Windows/Linux are not supported. Later documentation describes automatic OS detection and Linux/Windows service-management behavior, which directly contradicts the earlier platform limitation rather than merely adding detail.

Session Persistence

Medium

Category: Rogue Agent
Content: ## ✨ Features - 🔍 **Smart Status Query** - Auto-detect all OpenClaw instances - ✏️ **Modify Ports** - Automatically update config files + LaunchAgent plist - 🔄 **Restart Gateways** - Safely restart specific or all gateways - ✅ **Verify Configuration** - Check config consistency and port status - ➕ **Create Instances** - One-click creation with LaunchAgent setup
Confidence: 79% confidence
Finding: The English features section again states that the skill updates LaunchAgent plist files and creates instances with LaunchAgent setup. Because this establishes or modifies auto-start behavior, it is a genuine persistence-related capability with moderate security implications.

Session Persistence

Medium

Category: Rogue Agent
Content: # Verify config ~/.jvs/.openclaw/skills/gateway-manager/scripts/gateway-verify.sh local-shrimp # Create new instance ~/.jvs/.openclaw/skills/gateway-manager/scripts/gateway-create.sh test-bot 18899 openim # Delete instance (triple confirmation)
Confidence: 86% confidence
Finding: The documentation describes creating new gateway instances with LaunchAgent setup, which implies persistence on user login/session. Persistence is expected for a gateway manager, but it still creates code that auto-starts in the user's context and can expand the blast radius if a managed instance or config is compromised.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # macOS launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway.plist # Linux systemctl --user start openclaw-gateway
Confidence: 82% confidence
Finding: The same line also references the LaunchAgent plist itself, which is part of the persistence mechanism. Persisting user-level execution is not automatically malicious, but it increases risk if configuration or managed binaries are tampered with.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # macOS launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway.plist # Linux systemctl --user start openclaw-gateway
Confidence: 82% confidence
Finding: The same line also references the LaunchAgent plist itself, which is part of the persistence mechanism. Persisting user-level execution is not automatically malicious, but it increases risk if configuration or managed binaries are tampered with.

Session Persistence

Medium

Category: Rogue Agent
Content: ### 指令范围 Instruction Scope **审查意见：** > Scripts read/write user files, create LaunchAgent plists, scan ports, and perform rm -rf. **回应：** ✅ **这是预期行为** - 作为网关管理器，这些操作是必要的。
Confidence: 88% confidence
Finding: This is another duplicate of the same Chinese security-response text confirming creation of persistent LaunchAgent entries together with file write/delete capabilities. The combination is not inherently malicious, but it meaningfully increases operational and abuse risk.

Session Persistence

Medium

Category: Rogue Agent
Content: ### 指令范围 Instruction Scope **审查意见：** > Scripts read/write user files, create LaunchAgent plists, scan ports, and perform rm -rf. **回应：** ✅ **这是预期行为** - 作为网关管理器，这些操作是必要的。
Confidence: 88% confidence
Finding: This is another duplicate of the same Chinese security-response text confirming creation of persistent LaunchAgent entries together with file write/delete capabilities. The combination is not inherently malicious, but it meaningfully increases operational and abuse risk.

Session Persistence

Medium

Category: Rogue Agent
Content: ### 指令范围 Instruction Scope **审查意见:** > Scripts read/write user files, create LaunchAgent plists, scan ports, and perform rm -rf. **回应:** ✅ **这是预期行为** - 作为网关管理器,这些操作是必要的。
Confidence: 88% confidence
Finding: This is another duplicate of the same Chinese security-response text confirming creation of persistent LaunchAgent entries together with file write/delete capabilities. The combination is not inherently malicious, but it meaningfully increases operational and abuse risk.

Session Persistence

Medium

Category: Rogue Agent
Content: ### 持久性和权限 Persistence & Privilege **审查意见：** > Creates LaunchAgent plists for persistent execution. **回应：** ✅ **这是必要功能** - 网关需要开机自启。
Confidence: 92% confidence
Finding: This section explicitly states that LaunchAgent plists are created for persistent execution. That is a true persistence-related security behavior even if it is core functionality, because it causes code to run automatically in future sessions.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # macOS launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway.plist # Linux systemctl --user start openclaw-gateway
Confidence: 82% confidence
Finding: The plist reference on this line is part of the same persistence path. It is security-relevant because LaunchAgent contents determine what auto-runs on login, so any creation or modification of that file must be tightly controlled.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # macOS launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway.plist # Linux systemctl --user start openclaw-gateway
Confidence: 82% confidence
Finding: The plist reference on this line is part of the same persistence path. It is security-relevant because LaunchAgent contents determine what auto-runs on login, so any creation or modification of that file must be tightly controlled.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Instruction Scope **Review Feedback:** > Scripts read/write user files, create LaunchAgent plists, scan ports, and perform rm -rf. **Response:** ✅ **This is intended behavior** - These operations are necessary for a gateway manager.
Confidence: 88% confidence
Finding: This duplicate finding on the English security response is still a true persistence-related issue. The text frames persistence as necessary, but necessity does not remove the risk of unwanted auto-start if the mechanism is altered or misused.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/gateway-create.sh:87