Claw Seatbelt

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:29 PM UTC
• Version: 0.1.2

Overview

The skill appears intended to protect OpenClaw configs, but it can automatically overwrite the live config and force-restart the Gateway with unclear runtime scoping and weak safeguards.

Review this before installing or running unattended. It is meant to recover OpenClaw from bad config changes, but it may replace your active config with the newest backup and force-restart the Gateway whenever its status check fails. Use it only if you understand that behavior, trust the contents and permissions of ~/.openclaw/backups, and are comfortable with possible service interruption.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/watchdog.sh:8

Finding

Predictable Log File in a Shared Temporary Directory Permits Symlink Attacks

Content

View full analysis

Vulnerability Details

File Location: bin/watchdog.sh, lines 8-10
Vulnerability Type: Unsafe temporary file handling and symlink following
Risk Level: Medium

Vulnerable Code

bash

LOG_FILE="/tmp/openclaw-watchdog.log"

echo "[$(date)] Watchdog starting..." >> "$LOG_FILE"

Technical Analysis

The watchdog appends log data to the fixed, predictable path /tmp/openclaw-watchdog.log. Because /tmp is normally shared and writable by local users, another user can create that path before the watchdog runs. Shell redirection follows symbolic links, and the script does not verify the file type, ownership, or permissions before writing.

This creates a time-of-check/time-of-use and symlink-following weakness. The attacker must be able to create or replace the predictable path, while the watchdog's execution identity must have permission to append to the symlink target.

Attack Path

1. A local attacker observes that the watchdog always writes to /tmp/openclaw-watchdog.log.
2. The attacker creates that path as a symbolic link to another file.
3. A more privileged or otherwise targeted user runs bin/watchdog.sh.
4. The shell follows the symbolic link while processing the append redirection.
5. The watchdog appends its timestamped message to the attacker-selected target if the execution identity can write to it.

This does not provide arbitrary file content because the appended text is fixed apart from the date, but it can alter or corrupt a writable target.

Impact Assessment

Exploitation requires local access and does not independently grant code execution or additional privileges. It can cause unauthorized file modification under the watchdog process's existing privileges. If the script is run with elevated privileges, the scope may include privileged writable files; if run as a normal user, impact is limited to files writable by that user. The fixed log path can also allow log tamperin ...[truncated 23 chars]

Remediation

View remediation

Remediation Suggestions

• Store logs in a private directory such as $HOME/.openclaw/logs, with the directory mode set to 0700.
• Create the log file securely with restrictive permissions, such as 0600.
• Reject symbolic links and verify that any existing destination is a regular file owned by the expected user.
• If temporary storage is required, create a private directory using mktemp -d and clean it up with a trap.
• Avoid running the watchdog as root unless elevated privileges are strictly necessary.
• Consider using the system logging facility instead of manually writing to a shared temporary path.

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/watchdog.sh:17

Finding

Unvalidated and Non-Atomic Configuration Rollback Can Corrupt the Live Configuration

Content

View full analysis

Vulnerability Details

File Location: bin/watchdog.sh, lines 17-28
Vulnerability Type: Unsafe backup selection, unchecked file operations, and non-atomic replacement
Risk Level: Medium

Vulnerable Code

bash

    LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/openclaw-*.json 2>/dev/null | head -n 1)
    
    if [ -n "$LATEST_BACKUP" ]; then
        echo "[$(date)] 🔄 Attempting recovery using backup: $LATEST_BACKUP" >> "$LOG_FILE"
        
        # 3. 执行回滚 (先备份坏掉的，以防万一)
        cp "$CONFIG_FILE" "$BACKUP_DIR/failed-config-$(date +%Y%m%d-%H%M%S).json"
        cp "$LATEST_BACKUP" "$CONFIG_FILE"
        
        # 4. 重启 Gateway
        echo "[$(date)] 🚀 Restarting Gateway..." >> "$LOG_FILE"
        openclaw gateway restart --force

Technical Analysis

The script treats the newest pathname matching openclaw-*.json as a valid backup without confirming that it is a regular, non-symbolic-link file or that its contents are valid JSON and conform to the expected OpenClaw configuration schema.

The live configuration is overwritten directly with cp, so replacement is not atomic. Interruption, disk exhaustion, permission failures, or I/O errors can leave the destination incomplete or unchanged. Neither the snapshot operation nor the restore operation has its exit status checked. The script therefore proceeds to force-restart the Gateway even when preservation or restoration failed.

Selection through ls -t | head -n 1 is also fragile for unusual filenames and bases trust solely on modification time and filename pattern rather than backup integrity.

Attack Path

One applicable exploitation path is:

1. An attacker or compromised process with write access to ~/.openclaw/backups creates a malformed backup, a symlink, or an otherwise unsuitable file matching openclaw-*.json.
2. The attacker gives it the newest modification timestamp.
3. The Gateway health probe fails or is unavailable.

...[truncated 1286 chars]

Remediation

View remediation

Remediation Suggestions

• Enable robust error handling, for example with set -euo pipefail, while explicitly handling expected probe failures.
• Restrict $CONFIG_DIR and $BACKUP_DIR to the intended owner with appropriately restrictive permissions.
• Verify that the selected backup is a regular file, is owned by the expected user, and is not a symbolic link.
• Avoid parsing ls; select candidates using a filename-safe mechanism and trusted metadata.
• Validate the backup with a JSON parser and, where available, validate it against the expected OpenClaw configuration schema.
• Check the result of every snapshot, validation, copy, synchronization, and rename operation.
• Restore through a temporary file created in the same directory as openclaw.json, apply the required ownership and permissions, and atomically rename it over the live configuration only after successful validation.
• Do not restart the Gateway unless both preservation of the current configuration and atomic restoration complete successfully.
• Preserve a known-good backup separately and log failures without exposing sensitive configuration contents.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation presents conflicting execution models: it first says the skill only activates on-demand during backup/config changes, then says it primarily runs as a background watchdog. This can mislead users about persistence, monitoring behavior, and when automatic rollback or restarts may occur, which is security-relevant because users may unknowingly deploy a continuously running process with authority to modify configuration and restart services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description describes automatic restoration of configuration and Gateway restart behavior without a prominent warning about the operational consequences. Automatic rollback and service restart can interrupt availability, overwrite intentional but unverified changes, and obscure incident response if users are not clearly informed before enabling the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script overwrites the active configuration file with a backup and then performs a forced service restart. Although comments describe the behavior, there is no interactive confirmation or clear user-facing disclosure before these potentially disruptive actions occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description prominently uses Chinese for core explanatory content while the file otherwise includes English headings, and it does not indicate that the language choice is optional or region-specific. This can violate a language/locale policy that requires user choice or documented justification for locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file contains key operational descriptions only in Chinese, including the script purpose and recovery behavior. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.