doctor-call

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.3.0

Overview

The skill mostly matches its OpenClaw repair purpose, but its setup path creates a persistent background timer that repeatedly repairs and restarts services with inconsistent disclosure about how often it runs.

Install only if you want this skill to manage OpenClaw health and restarts. Before running doctor-call setup, treat it as enabling a persistent background job that can repair configuration and restart the gateway every 5 minutes; verify the service path, timer frequency, and removal behavior first.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: scripts/doctor-call.sh:107

Finding

Persistent Systemd Timer Executes Automated Repair Operations Across Sessions

Content

View full analysis

Vulnerability Details

File Location: scripts/doctor-call.sh, lines 107–139
Vulnerability Type: T06: System Persistence
Risk Level: High

The setup action creates, enables, and immediately starts a systemd user timer. This timer survives the original Skill invocation and repeatedly executes the fix action every five minutes.

bash

elif [ "$ACTION" = "setup" ]; then
    # Set up systemd user timer (no sudo needed!)
    echo -e "${GREEN}🔧 Setting up auto-restart via systemd...${NC}"
    echo ""

    mkdir -p ~/.config/systemd/user

    # Create systemd service (user-level, no sudo needed)
    cat > ~/.config/systemd/user/openclaw-health.service <<'EOF'
[Unit]
Description=OpenClaw Health Monitor

[Service]
Type=oneshot
ExecStart=/home/umbrel/.openclaw/skills/doctor-call/scripts/doctor-call.sh fix
StandardOutput=journal
StandardError=journal
EOF

    # Create systemd timer (runs every 5 minutes)
    cat > ~/.config/systemd/user/openclaw-health.timer <<'EOF'
[Unit]
Description=Run OpenClaw health check every 5 minutes

[Timer]
OnBootSec=30
OnUnitActiveSec=5min
Unit=openclaw-health.service

[Install]
WantedBy=default.target
EOF

    systemctl --user daemon-reload
    systemctl --user enable openclaw-health.timer
    systemctl --user start openclaw-health.timer

Technical Analysis

Enabling a systemd timer establishes cross-session scheduled execution under the affected user's account. Thirty seconds after the user service manager starts, and every five minutes thereafter, systemd invokes the service's hard-coded script path with the fix argument.

The invoked repair path can run openclaw doctor --repair and restart openclaw-gateway. Consequently, configuration changes and service restarts may occur without new approval in later sessions.

The ExecStart value is hard-coded to /home/umbrel/.openclaw/skills/doctor-call/scripts/doctor-call.sh rather th ...[truncated 1871 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic creation and activation of persistent systemd units from the normal Skill workflow. Prefer a one-shot health check that runs only when explicitly requested.
2. If recurring monitoring is essential, distribute separately reviewable service and timer templates and require explicit, informed approval before installation and activation.
3. Clearly disclose that the task survives the current session, its exact five-minute frequency, the commands it can run, and the supported removal procedure.
4. Resolve the script's canonical absolute path during installation instead of using /home/umbrel/.... Validate that the target is a regular file owned by the expected user and is not writable by untrusted users.
5. Consider copying an integrity-verified executable into a user-owned, non-shared installation directory and reference that exact protected path from ExecStart.
6. Check the exit status of unit creation, daemon-reload, enable, and start; do not report success when any operation fails.
7. Make the documented and displayed interval match the timer configuration.
8. Require separate confirmation before any recurring task performs configuration repair or gateway restart. A safer timer should perform read-only health checks and only emit an alert.
9. Ensure remove stops and disables the timer, deletes both unit files, reloads systemd, resets failed state where necessary, and verifies that no active or enabled unit remains.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill advertises diagnostics and repair, but it also describes persistent systemd-based automation that changes service state and installs/removes timer units. That is a meaningful privilege and persistence boundary: users may invoke it expecting a one-time health check while it actually establishes recurring execution and automatic restarts, and the stated schedule is internally inconsistent (hourly vs every 5 minutes), which undermines informed consent and safe review.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 160)May include surrounding context.

sh

echo -e "${YELLOW}🗑️  Removing auto-restart...${NC}"
    systemctl --user stop openclaw-health.timer 2>/dev/null || true
    systemctl --user disable openclaw-health.timer 2>/dev/null || true
    rm -f ~/.config/systemd/user/openclaw-health.service
    rm -f ~/.config/systemd/user/openclaw-health.timer
    systemctl --user daemon-reload
    echo -e "${GREEN}✅ Auto-restart removed${NC}"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 161)May include surrounding context.

sh

systemctl --user stop openclaw-health.timer 2>/dev/null || true
    systemctl --user disable openclaw-health.timer 2>/dev/null || true
    rm -f ~/.config/systemd/user/openclaw-health.service
    rm -f ~/.config/systemd/user/openclaw-health.timer
    systemctl --user daemon-reload
    echo -e "${GREEN}✅ Auto-restart removed${NC}"
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 36)May include surrounding context.

sh

echo -e "${GREEN}✅ Memory: ${MEM_FREE}MB free${NC}"
    
    # Check if user timer is enabled
    if systemctl --user is-enabled openclaw-health.timer 2>/dev/null | grep -q "enabled"; then
        echo -e "${GREEN}✅ Auto-restart: Enabled (every 1 hour)${NC}"
    else
        echo -e "${YELLOW}⚠️  Auto-restart: Not enabled (run 'doctor-call setup')${NC}"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

When the timer is enabled, the status output tells the user it runs 'every 1 hour'. But the setup logic writes a timer with OnUnitActiveSec=5min, so the script's runtime messaging actively misrepresents what it does. This is a direct contradiction between code documentation/output and actual behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 110)May include surrounding context.

sh

fi

elif [ "$ACTION" = "setup" ]; then
    # Set up systemd user timer (no sudo needed!)
    echo -e "${GREEN}🔧 Setting up auto-restart via systemd...${NC}"
    echo ""

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 116)May include surrounding context.

sh

fi

elif [ "$ACTION" = "setup" ]; then
    # Set up systemd user timer (no sudo needed!)
    echo -e "${GREEN}🔧 Setting up auto-restart via systemd...${NC}"
    echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

Creating user-level systemd unit files in ~/.config/systemd/user is part of establishing persistence. While not privileged, it introduces durable background behavior in an agent skill, which is more sensitive because users may not expect a diagnostic helper to install recurring execution artifacts.

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 114)May include surrounding context.

sh

echo -e "${GREEN}🔧 Setting up auto-restart via systemd...${NC}"
    echo ""
    
    mkdir -p ~/.config/systemd/user
    
    # Create systemd service (user-level, no sudo needed)
    cat > ~/.config/systemd/user/openclaw-health.service <<'EOF'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup action creates persistent user-level systemd units and immediately enables/starts them without a clear warning or explicit confirmation. In an agent skill context, establishing persistence is security-relevant because it causes recurring execution of a repair script that can restart services and invoke repair commands long after the initial run.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

Enabling a user systemd timer establishes persistent scheduled execution for this skill, causing it to run automatically in future sessions. In this skill's context, the timer repeatedly invokes a script that can run openclaw doctor --repair and restart the gateway, so persistence increases the blast radius of mistakes or abuse.

Content

Scanner excerpt · scripts/doctor-call.sh (reported line 143)May include surrounding context.

sh

EOF

    systemctl --user daemon-reload
    systemctl --user enable openclaw-health.timer
    systemctl --user start openclaw-health.timer
    
    echo ""

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's user-facing documentation says the timer 'runs every 1 hour' and the status path also reports 'Enabled (every 1 hour)'. However, the timer file created in setup uses OnUnitActiveSec=5min, so the documented behavior contradicts the actual configured schedule. This is an intent/documentation mismatch, not just an omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This branch removes files from ~/.config/systemd/user and disables the timer, which is a destructive change to the user's configuration. The script announces removal, but it does not explicitly warn that files will be deleted or ask for confirmation before performing the irreversible cleanup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.