Gateway Monitor Auto Restart

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:22 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-aligned, but installation creates an indefinite scheduled monitor that can restart services and kill matching processes with weak safeguards.

Review before installing. This skill may be acceptable for a personal test machine where you intentionally want automatic gateway recovery, but it should not be used as-is on production or shared systems. Install only from a trusted, access-controlled path, inspect the generated crontab entry, understand that it can restart or re-register the gateway and kill matching processes, and be prepared to remove the cron entry manually.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Warning

• Location: setup.sh:12

Finding

Persistent Scheduled Execution Through User Crontab

Content

View full analysis

/dev/null | grep -v "gateway_monitor.sh"; echo "0 */3 * * * cd $(pwd) && ./gateway_monitor.sh >> $HOME/.openclaw/logs/cron_monitor.log 2>&1") | crontab - ``` ### Technical Analysis The setup script modifies the installing user's crontab and registers `gateway_monitor.sh` for execution every three hours. The task survives the setup process and subsequent login sessions. Scheduled monitoring is consistent with the Skill's declared functionality and is disclosed in `SKILL.md` and `README.md`. Nevertheless, it establishes cross-session persistence and repeatedly executes a script from the project directory. No integrity check, trusted installation location, explicit confirmation, or uninstall mechanism is provided. If another user or process can modify the project directory or `gateway_monitor.sh`, the cron task becomes a recurring command-execution mechanism. The implementation also replaces the user's complete crontab through a filtering pipeline rather than managing an isolated, uniquely identified entry. ### Attack Path 1. The user runs `setup.sh`. 2. The script installs a cron entry that executes `gateway_monitor.sh` every three hours. 3. The project directory or monitoring script remains writable by an attacker or compromised process operating under an account with suitable filesystem access. 4. The attacker modifies or replaces `gateway_monitor.sh`. 5. At the next scheduled interval, cron executes the modified script as the user who installed the Skill. 6. The malicious modification continues to execute every three hours until the cron entry is removed. ### Impact Assessment Successful exploitation provides recurring command execution with the privileges of the installing user. It does not independently grant root acces ...[truncated 357 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: setup.sh:13

Finding

Unsafe Working-Directory Interpolation into Cron Command

Content

View full analysis

/dev/null | grep -v "gateway_monitor.sh"; echo "0 */3 * * * cd $(pwd) && ./gateway_monitor.sh >> $HOME/.openclaw/logs/cron_monitor.log 2>&1") | crontab - ``` ### Technical Analysis The output of `pwd` is embedded directly into executable cron syntax without shell quoting or validation. Directory names may legally contain spaces, shell metacharacters, command-substitution syntax, percent characters, or newlines. Although the path is obtained locally, a crafted directory name can be written into the crontab and interpreted later by the shell used by cron. Characters such as semicolons can terminate the intended `cd` command and introduce additional commands. Percent characters also have special meaning in many cron implementations. Ordinary spaces can cause the legitimate task to fail. The command also removes every existing crontab line containing the substring `gateway_monitor.sh`: ```bash crontab -l 2>/dev/null | grep -v "gateway_monitor.sh" ``` This is broader than necessary and can delete unrelated tasks maintained by the user. ### Attack Path 1. An attacker prepares or controls a project directory whose name contains shell syntax, such as a command separator followed by an attacker-selected command. 2. The victim navigates to that directory and runs `setup.sh`. 3. `$(pwd)` expands to the crafted path and is inserted unquoted into the generated cron line. 4. The generated line is installed in the victim's crontab. 5. At the next three-hour interval, cron passes the line to a shell. 6. The shell interprets the injected syntax and executes the attacker-selected command as the victim. 7. Because the command is stored in cron, execution can recur at every scheduled interval. ### Impact Assessment An attacker who can influence the installation path can obtain recurr ...[truncated 555 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: gateway_monitor.sh:67

Finding

Overbroad Process Termination Using Command-Line Pattern Matching

Content

View full analysis

/dev/null; then log_message "Found existing gateway processes - killing them before restart" pkill -f "openclaw-gateway" 2>/dev/null || true sleep 2 fi ``` ### Technical Analysis The `-f` option makes `pgrep` and `pkill` match against complete command lines rather than a verified executable identity or service PID. Any accessible process whose command line contains `openclaw-gateway` may therefore be selected. The script does not verify that matched processes: - Belong to the expected OpenClaw gateway service. - Were started from the expected executable. - Correspond to the service instance being monitored. - Are safe to terminate. - Have received a graceful shutdown request before forced termination. This diagnostic function runs after the status check fails and before a restart is attempted. A transient status-check failure can consequently trigger termination of unrelated matching processes. ### Attack Path 1. A process runs with `openclaw-gateway` anywhere in its command line, whether as the executable name or merely as an argument. 2. The OpenClaw status command fails or does not produce output containing `running`. 3. The script invokes `diagnose_issues`. 4. `pgrep -f` detects the matching command line. 5. `pkill -f` sends a termination signal to all processes the invoking user is permitted to signal that match the text. 6. The unrelated process is terminated, causing service interruption or loss of in-memory work. A local attacker could deliberately include the string in a victim process's arguments to induce its termination when the monitor runs, although the attacker would still need the process and permission conditions necessary for the monitor's account to signal it. ### Impact Assessment The maximum scope is ...[truncated 533 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · setup.sh (reported line 13)May include surrounding context.

sh

#!/bin/bash
# Setup script for Gateway Monitor Auto-Restart Skill

echo "Setting up Gateway Monitor Auto-Restart Skill..."

# Make the gateway monitor script executable
chmod +x gateway_monitor.sh

# Create logs directory if it doesn't exist
mkdir -p "$HOME/.openclaw/logs"

# Add cron job for 3-hour checks
(crontab -l 2>/dev/null | grep -v "gateway_monitor.sh"; echo "0 */3 * * * cd $(pwd) && ./gateway_monitor.sh >> $HOME/.openclaw/logs/cron_monitor.log 2>&1") | crontab -

echo "Gateway Monitor Auto-Restart Skill has been installed!"
echo "The monitoring script will run every 3 hours to check and restart the gateway if needed."
echo "Logs will be stored in $HOME/.openclaw/logs/"
echo ""
echo "To manually run the monitor: ./gateway_monitor.sh"
echo "To view logs: tail -f $HOME/.openclaw/logs/gateway_monitor.log"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly advertises automatic monitoring and automatic restarts of the gateway, but it does not clearly warn users that installation will set up recurring behavior and perform system-modifying recovery actions. In a skill that appears designed to manage a system service, this omission can lead users to install persistent automation without understanding that it will continuously run and restart components, which increases operational and security risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

md

If you encounter issues:
1. Check the logs in `~/.openclaw/logs/`
2. Ensure the gateway is properly installed: `openclaw gateway status`
3. Verify cron permissions: `crontab -l`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation describes automatic installation of a cron job and automatic restarting of a gateway service, but it does not clearly warn the user that it will create persistence and take operational actions without further confirmation. In a security-sensitive or production environment, undisclosed scheduled tasks and service restarts can cause availability issues, mask underlying compromises, or violate change-control expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Lines L049-L051 stop and recreate the gateway service using launchctl and OpenClaw install/start commands, which changes system service state and may interrupt ongoing sessions. The inline logs describe the attempt, but there is no clear user disclosure that the script will perform these potentially disruptive recovery actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script unconditionally runs pkill -f "openclaw-gateway", which can terminate processes based on a broad pattern match without user confirmation. This can cause denial of service or kill unintended processes if another command line matches the same substring, especially when the script runs unattended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 12)May include surrounding context.

sh

# Create logs directory if it doesn't exist
mkdir -p "$HOME/.openclaw/logs"

# Add cron job for 3-hour checks
(crontab -l 2>/dev/null | grep -v "gateway_monitor.sh"; echo "0 */3 * * * cd $(pwd) && ./gateway_monitor.sh >> $HOME/.openclaw/logs/cron_monitor.log 2>&1") | crontab -

echo "Gateway Monitor Auto-Restart Skill has been installed!"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The script installs a persistent cron job that will execute indefinitely every 3 hours, modifying the user's scheduled tasks without prompting for explicit consent or providing an uninstall path. Persistence mechanisms are security-relevant because they create long-lived execution of whatever gateway_monitor.sh contains, and the use of cd $(pwd) && ./gateway_monitor.sh ties execution to a potentially mutable directory path.

Content

Scanner excerpt · setup.sh (reported line 13)May include surrounding context.

sh

mkdir -p "$HOME/.openclaw/logs"

# Add cron job for 3-hour checks
(crontab -l 2>/dev/null | grep -v "gateway_monitor.sh"; echo "0 */3 * * * cd $(pwd) && ./gateway_monitor.sh >> $HOME/.openclaw/logs/cron_monitor.log 2>&1") | crontab -

echo "Gateway Monitor Auto-Restart Skill has been installed!"
echo "The monitoring script will run every 3 hours to check and restart the gateway if needed."

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file comment says this is a "Gateway Monitor and Auto-Restart Script," which implies health checking and restart actions. However, the implementation's diagnosis step explicitly kills any process matching "openclaw-gateway" before restart, which is a stronger and more destructive action than the stated intent suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.