Openclaw Gateway Fd Fix

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:07 PM UTC
• Version: 1.0.0

Overview

The skill is a disclosed troubleshooting script, but it performs destructive cleanup and persistent LaunchAgent changes with unsafe shell handling that could delete unintended files or break the gateway service.

Review this skill carefully before installing or running it. Use it only if you understand that it can permanently delete workspace dependency directories and modify your macOS OpenClaw Gateway LaunchAgent. Safer use would involve listing targets first, backing up important workspace content, and fixing the script to use NUL-delimited path handling plus plist-aware validation and rollback before any service restart.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: fix.sh:49

Finding

Unquoted Path Expansion in Recursive Directory Deletion

Content

View full analysis

Remediation

View remediation

0 )); then printf ' - %q\n' "${TARGETS[@]}" read -r -p " Delete these directories? [y/N] " REPLY if [[ "$REPLY" =~ ^[Yy]$ ]]; then for dir in "${TARGETS[@]}"; do rm -rf -- "$dir" done fi fi ``` Additional hardening should include: - Canonicalize `$WORKSPACE` and every deletion target before deletion. - Verify each canonical target remains strictly beneath the canonical workspace path. - Reject symbolic links or unexpected path types where appropriate. - Use `--` before path arguments to prevent names beginning with `-` from being treated as options. - Print each target using shell-safe escaping, such as `printf '%q'`. - Consider requiring confirmation for each target or moving directories to a quarantine location before permanent deletion. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: fix.sh:75

Finding

Non-Structural Plist Modification Can Corrupt the LaunchAgent Configuration

Content

View full analysis

/i\ HardResourceLimits\ \ NumberOfFiles\ 524288\ \ SoftResourceLimits\ \ NumberOfFiles\ 524288\ \ ' "$PLIST" ``` ### Technical Analysis The `sed` expression inserts the resource-limit block before every line matching ``. Property-list files commonly contain nested dictionaries, and `sed` does not understand XML structure. The inserted keys are therefore not guaranteed to be added only to the root dictionary. If the existing LaunchAgent contains nested dictionaries, the command may add resource-limit keys at multiple levels, introduce duplicate keys, or create semantically invalid configuration. The script performs no `plutil` validation after modification. This is particularly disruptive because the script subsequently unloads the existing LaunchAgent before attempting to bootstrap the modified file: ```bash launchctl bootout gui/$(id -u) "$PLIST" 2>/dev/null || true launchctl bootstrap gui/$(id -u) "$PLIST" ``` Although a timestamped backup is created, the script does not automatically restore that backup if validation or bootstrap fails. ### Attack Path 1. The existing `ai.openclaw.gateway.plist` contains one or more nested `` elements, as is valid and common in LaunchAgent configurations. 2. The user runs the advertised one-click repair script. 3. The script inserts the complete resource-limit block before every closing dictionary tag. 4. The resulting plist contains misplaced or duplicate resource-limit definitions. 5. The script unloads the currently running Gateway LaunchAgent. 6. `launchctl bootstrap` rejects the malformed configuration o ...[truncated 1040 chars]

Remediation

View remediation

/dev/null || true /usr/libexec/PlistBuddy -c \ "Add :HardResourceLimits:NumberOfFiles integer 524288" "$PLIST" /usr/libexec/PlistBuddy -c \ "Delete :SoftResourceLimits:NumberOfFiles" "$PLIST" 2>/dev/null || true /usr/libexec/PlistBuddy -c \ "Add :SoftResourceLimits:NumberOfFiles integer 524288" "$PLIST" ``` The implementation should also: 1. Create the backup before any modification, including updates to existing values. 2. Modify a temporary copy instead of the active plist. 3. Validate the temporary file with: ```bash plutil -lint "$TEMP_PLIST" ``` 4. Replace the active plist atomically only after validation succeeds. 5. Validate that both values exist at the intended root paths. 6. Do not unload the running service until the new plist has passed validation. 7. If `launchctl bootstrap` fails, restore the backup automatically and attempt to reload the known-good configuration. 8. Report the backup location and recovery outcome clearly to the user. The LaunchAgent modification itself is disclosed and consistent with the documented repair purpose; the security issue is the unsafe implementation rather than undisclosed persistence. ]]>

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (29)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This finding is a true positive because the command explicitly performs recursive forced deletion on a wildcard path. In a troubleshooting skill, the context makes the intent legitimate, but the lack of safeguards means a user could still suffer avoidable data loss from overbroad or unreviewed deletion.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

1. Remove large directories from workspace:

   bash

   # Never put these inside ~/.openclaw/workspace/:
   rm -rf ~/.openclaw/workspace/*/.venv
   rm -rf ~/.openclaw/workspace/*/node_modules
   # Move datasets/models/venvs to ~/Downloads/ or /tmp/
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This finding is a true positive because the command explicitly performs recursive forced deletion on a wildcard path. In a troubleshooting skill, the context makes the intent legitimate, but the lack of safeguards means a user could still suffer avoidable data loss from overbroad or unreviewed deletion.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

1. Remove large directories from workspace:

   bash

   # Never put these inside ~/.openclaw/workspace/:
   rm -rf ~/.openclaw/workspace/*/.venv
   rm -rf ~/.openclaw/workspace/*/node_modules
   # Move datasets/models/venvs to ~/Downloads/ or /tmp/
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This is also a true positive because it uses rm -rf with a glob to remove dependency directories in bulk. The surrounding context lowers suspicion of maliciousness, but does not remove the operational risk of destructive file removal without confirmation or path review.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash

   # Never put these inside ~/.openclaw/workspace/:
   rm -rf ~/.openclaw/workspace/*/.venv
   rm -rf ~/.openclaw/workspace/*/node_modules
   # Move datasets/models/venvs to ~/Downloads/ or /tmp/

2. Update LaunchAgent resource limits:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This is also a true positive because it uses rm -rf with a glob to remove dependency directories in bulk. The surrounding context lowers suspicion of maliciousness, but does not remove the operational risk of destructive file removal without confirmation or path review.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash

   # Never put these inside ~/.openclaw/workspace/:
   rm -rf ~/.openclaw/workspace/*/.venv
   rm -rf ~/.openclaw/workspace/*/node_modules
   # Move datasets/models/venvs to ~/Downloads/ or /tmp/

2. Update LaunchAgent resource limits:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The script captures newline-delimited find results into a scalar and then passes them to 'rm -rf' unquoted, allowing word splitting and pathname expansion. If a matched directory name contains spaces, glob characters, or begins with a dash, the deletion can fail unpredictably or target unintended paths, making this dangerous in a cleanup script that recursively removes directories.

Content

Scanner excerpt · fix.sh (reported line 48)May include surrounding context.

sh

read -p "   Delete these directories? [y/N] " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        [[ -n "$VENVS" ]] && rm -rf $VENVS
        [[ -n "$NODE_MODULES" ]] && rm -rf $NODE_MODULES
        echo "✅ Cleaned up dependency directories"
        NEW_FILE_COUNT=$(find "$WORKSPACE" -type f | wc -l | xargs)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

This deletion of node_modules repeats the same unsafe pattern: unquoted expansion of a variable containing one or more filesystem paths from 'find'. In a workspace containing crafted names, the command can remove the wrong directories or interpret path fragments as separate arguments/options, which is especially risky because 'rm -rf' is destructive and recursive.

Content

Scanner excerpt · fix.sh (reported line 49)May include surrounding context.

sh

echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        [[ -n "$VENVS" ]] && rm -rf $VENVS
        [[ -n "$NODE_MODULES" ]] && rm -rf $NODE_MODULES
        echo "✅ Cleaned up dependency directories"
        NEW_FILE_COUNT=$(find "$WORKSPACE" -type f | wc -l | xargs)
        echo "   New workspace file count: $NEW_FILE_COUNT"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill presents destructive rm -rf commands as a manual remediation step without an explicit warning to review targets, back up data, or confirm that the matched directories are disposable. Even though the paths are scoped to the OpenClaw workspace, users could still lose important project environments or dependencies if they copied valuable data into those locations.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

sleep 10 && openclaw gateway status

text

## Permanent Rule (NEVER BREAK)
✅ **Do NOT put these inside `~/.openclaw/workspace/`:**
- Python virtual environments (`.venv`, `venv`)
- Node.js `node_modules` directories

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 17)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 61)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 68)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 70)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 73)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 88)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 17)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 18)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 60)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 61)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 67)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 70)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · fix.sh (reported line 71)May include surrounding context.

sh

fi

WORKSPACE="$HOME/.openclaw/workspace"
PLIST="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
BACKUP_PLIST="$PLIST.bak.$(date +%Y%m%d%H%M%S)"

# Step 1: Check workspace file count

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:51