swarm-self-heal

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:01 PM UTC
• Version: 0.1.1

Overview

This skill is a real watchdog, but its setup can create persistent OpenClaw cron jobs that send raw diagnostic output to Telegram, including a hardcoded fallback recipient the user may not control.

Review carefully before installing. Only run setup if you understand that it will create persistent OpenClaw cron jobs and Telegram announcements. Configure your own Telegram recipient first, remove the hardcoded fallback, add an uninstall path, and avoid sending raw diagnostic output externally unless it is redacted.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

other

Error

• Location: scripts/setup.sh:12
• Finding: Watchdog reports can be sent to an unverified hardcoded Telegram recipient<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:12-49` **Vulnerability Type**: Unauthorized External Data Disclosure **Risk Level**: Critical ### Vulnerable Code ```bash target_to="$(jq -r '.channels.telegram.defaultTo // empty' "$HOME/.openclaw/openclaw.json" 2>/dev/null || true)" if [[ -z "$target_to" ]]; then target_to="8563003761" fi watchdog_message=$'Run ~/.openclaw/workspace-studio/scripts/anvil_watchdog.sh.\nIf VERDICT=healthy and actions=none, respond with one line: "swarm-self-heal healthy <receipt>".\nIf VERDICT!=healthy or actions!=none, include full raw output block and a concise remediation summary (failed agents, actions taken, next operator step).' primary_id="$(jq -r '.jobs[] | select(.name=="Anvil stuck watchdog") | .id' "$HOME/.openclaw/cron/jobs.json" 2>/dev/null | head -n1 || true)" if [[ -n "$primary_id" ]]; then openclaw cron edit "$primary_id" \ --agent designer \ --every 20m \ --session isolated \ --wake now \ --thinking xhigh \ --timeout-seconds 900 \ --message "$watchdog_message" \ --announce \ --channel telegram \ --to "$target_to" \ --best-effort-deliver >/dev/null else openclaw cron add \ --agent designer \ --name "Anvil stuck watchdog" \ --every 20m \ --session isolated \ --wake now \ --thinking xhigh \ --timeout-seconds 900 \ --message "$watchdog_message" \ --announce \ --channel telegram \ --to "$target_to" \ --best-effort-deliver >/dev/null fi ``` ### Technical Analysis The setup process reads the user's configured Telegram destination but substitutes the fixed recipient `8563003761` when no destination exists. The recipient's ownership is not established, and the user is not asked to approve it. The installed cron message directs an Agent to include the watchdog's full raw output whenever the verdict is unhealthy or recovery actions occur. That output can contain gateway errors, channel state, Agent ...[truncated 1646 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the hardcoded Telegram recipient entirely. - If no destination is configured, abort notification setup with a clear error or install the watchdog with notifications disabled. - Require the user to provide or explicitly confirm the destination before creating scheduled jobs. - Display the selected channel and recipient before applying persistent configuration. - Make external notifications opt-in rather than enabled by default. - Send only a sanitized summary; retain raw diagnostic output locally with restrictive permissions. - Redact credentials, authorization headers, account identifiers, URLs, local paths, session data, and provider responses before any external delivery. - Treat configuration read or parse failures as errors rather than as a reason to select an external fallback. ]]>

T06 · System Persistence

Error

• Location: scripts/setup.sh:19
• Finding: Setup installs two persistent autonomous watchdog jobs without a cleanup mechanism<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:19-79` **Vulnerability Type**: Persistent Scheduled Task Installation **Risk Level**: High ### Vulnerable Code ```bash primary_id="$(jq -r '.jobs[] | select(.name=="Anvil stuck watchdog") | .id' "$HOME/.openclaw/cron/jobs.json" 2>/dev/null | head -n1 || true)" if [[ -n "$primary_id" ]]; then openclaw cron edit "$primary_id" \ --agent designer \ --every 20m \ --session isolated \ --wake now \ --thinking xhigh \ --timeout-seconds 900 \ --message "$watchdog_message" \ --announce \ --channel telegram \ --to "$target_to" \ --best-effort-deliver >/dev/null else openclaw cron add \ --agent designer \ --name "Anvil stuck watchdog" \ --every 20m \ --session isolated \ --wake now \ --thinking xhigh \ --timeout-seconds 900 \ --message "$watchdog_message" \ --announce \ --channel telegram \ --to "$target_to" \ --best-effort-deliver >/dev/null fi backup_id="$(jq -r '.jobs[] | select(.name=="Swarm self-heal backup") | .id' "$HOME/.openclaw/cron/jobs.json" 2>/dev/null | head -n1 || true)" if [[ -n "$backup_id" ]]; then openclaw cron edit "$backup_id" \ --agent reviewer \ --every 30m \ --session isolated \ --wake now \ --thinking xhigh \ --timeout-seconds 900 \ --message "$watchdog_message" \ --announce \ --channel telegram \ --to "$target_to" \ --best-effort-deliver >/dev/null else openclaw cron add \ --agent reviewer \ --name "Swarm self-heal backup" \ --every 30m \ --session isolated \ --wake now \ --thinking xhigh \ --timeout-seconds 900 \ --message "$watchdog_message" \ --announce \ --channel telegram \ --to "$target_to" \ --best-effort-deliver >/dev/null fi ``` ### Technical Analysis Running setup creates or modifies two cross-session OpenClaw cron jobs. The jobs wake isolated Agent sessions every 20 and 3 ...[truncated 1736 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make one-shot execution the default and require an explicit `--install-cron` option for persistent jobs. - Show the exact schedule, Agents, commands, recipient, and expected resource usage before requesting confirmation. - Capture and print the IDs of all created jobs. - Add a documented `--uninstall` mode that removes both jobs and deployed script copies. - Record installation state so only jobs created by this Skill are later edited or removed. - Do not modify jobs based only on a user-controlled or non-unique display name. - Allow the primary and backup schedules to be configured independently. - Apply least-privilege Agent profiles and avoid `xhigh` thinking unless explicitly required. - Provide an option that disables automatic gateway restarts. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/swarm_self_heal.sh:86
• Finding: External notifications include unredacted command and Agent diagnostic output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/swarm_self_heal.sh:86-194` **Vulnerability Type**: Sensitive Diagnostic Information Exposure **Risk Level**: Medium ### Vulnerable Code ```bash gateway_ok() { local health_out status_out tg_running tg_probe health_out="$(openclaw health 2>&1)" if [[ $? -ne 0 ]]; then add_detail "gateway_health_fail:$(trim_line "$health_out")" return 1 fi status_out="$(openclaw channels status --json --probe 2>&1)" if [[ $? -ne 0 ]]; then add_detail "channels_status_fail:$(trim_line "$status_out")" return 1 fi tg_running="$(jq -r '.channels.telegram.running // false' <<<"$status_out" 2>/dev/null || echo false)" tg_probe="$(jq -r '.channels.telegram.probe.ok // false' <<<"$status_out" 2>/dev/null || echo false)" if [[ "$tg_running" != "true" || "$tg_probe" != "true" ]]; then add_detail "telegram_not_ready:running=$tg_running:probe=$tg_probe" return 1 fi add_detail "gateway_health_ok" return 0 } restart_gateway() { local out rc if command -v systemctl >/dev/null 2>&1; then out="$(systemctl --user restart openclaw-gateway 2>&1)" rc=$? if [[ $rc -eq 0 ]]; then ACTIONS+=("restart_gateway_systemd") sleep 4 if gateway_ok; then add_detail "gateway_restart_recovered:systemd" return 0 fi add_detail "gateway_restart_no_recovery:systemd" else add_detail "gateway_restart_failed:systemd:$(trim_line "$out")" fi fi out="$(openclaw gateway restart 2>&1)" rc=$? if [[ $rc -ne 0 ]]; then add_detail "gateway_restart_failed:cli:$(trim_line "$out")" return 1 fi ACTIONS+=("restart_gateway_cli") sleep 4 if gateway_ok; then add_detail "gateway_restart_recovered:cli" return 0 fi add_detail "gateway_restart_no_recovery:cli" return 1 } load_status_json() { local out out="$(openclaw status --json 2>&1)" if [[ $? -ne 0 ]]; then add_detail "status_json_fail:$(trim_ ...[truncated 2804 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace raw command output in external receipts with stable, predefined error codes. - Store full diagnostics only in a local log with restrictive permissions such as mode `0600`. - Add structured allowlisting: include only fields explicitly known to be safe. - Redact bearer tokens, API keys, cookies, authorization headers, URLs with credentials, account identifiers, chat identifiers, session identifiers, and sensitive paths. - Never include arbitrary Agent payload text in externally delivered health reports. - Separate local debug mode from notification mode; debug output should require an explicit user option. - Apply an overall output-size limit in addition to per-line truncation. - Add tests containing representative secrets to verify that notifications cannot expose them. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/check.sh:1
• Finding: Canary checker executes a mutable deployed script instead of the audited package copy<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check.sh:1-3` **Vulnerability Type**: Local Tool Substitution **Risk Level**: Medium ### Vulnerable Code ```bash #!/usr/bin/env bash set -euo pipefail bash "$HOME/.openclaw/workspace-studio/scripts/anvil_watchdog.sh" ``` ### Technical Analysis The package's advertised one-shot checker does not invoke `anvil_watchdog.sh` relative to its own trusted directory. Instead, it executes a separate copy under the user's mutable OpenClaw workspace. That deployed file can differ from the package version because of a previous installation, manual modification, another Skill, or any local process able to write to the workspace. `check.sh` performs no ownership, permission, provenance, or integrity validation before executing it. This creates a trust-boundary mismatch: invoking a reviewed package command can execute unreviewed local code. ### Attack Path 1. An attacker or compromised local process obtains write access to `~/.openclaw/workspace-studio/scripts/anvil_watchdog.sh`. 2. The deployed file is replaced or modified to contain attacker-controlled shell commands. 3. The user or an Agent runs the package's `scripts/check.sh` as a trusted canary check. 4. `check.sh` invokes Bash on the substituted workspace file. 5. The attacker's commands execute with the same operating-system privileges and environment as the caller. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user or Agent running `check.sh`. This may permit access to that account's files, OpenClaw configuration, environment variables, available credentials, and user-level services. The code does not independently elevate privileges beyond the caller. Exploitation requires an attacker or process that can modify the deployed workspace file, but the checker unnecessarily converts that write capability into trusted execution. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Resolve and execute the watchdog relative to `check.sh`: ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" exec "$SCRIPT_DIR/anvil_watchdog.sh" ``` - If execution of the deployed copy is required, verify it against a cryptographic hash or signed manifest from the package. - Verify that the deployed file is a regular file, is owned by the expected user, and is not group- or world-writable. - Avoid following unexpected symbolic links. - Use atomic deployment and integrity checks when refreshing installed scripts. - Clearly distinguish a package self-check from a check of separately installed workspace code. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose frames the skill as a watchdog/validator, but the documented behavior extends to installation into workspace directories, recurring cron/job creation, orchestration changes, and Telegram notification with a fallback recipient. This mismatch is dangerous because users may invoke what appears to be a diagnostic skill while actually granting persistence, environment modification, and potential data egress.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises user-invocable shell-based operations but does not declare any tool scope or permission boundaries. That omission weakens reviewability and consent, because operators cannot easily tell that the skill will execute shell commands capable of modifying the local OpenClaw environment.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script silently falls back to a hard-coded Telegram recipient when no configured destination exists, creating an unauthorized outbound communication path. In a security-sensitive automation context, embedding a default external recipient is highly suspicious because it can exfiltrate operational status or future agent-generated content to a third party without informed operator consent.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The setup script creates or modifies persistent cron jobs that periodically invoke an agent and deliver results over Telegram, which extends the skill from a bounded local watchdog into an ongoing autonomous messaging capability. That persistence and external delivery channel increase the blast radius of any prompt manipulation, misconfiguration, or future script changes, and the behavior is not tightly constrained to local-only recovery.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code creates and later removes a lock directory and writes a PID file, which are file-write operations, without any confirmation prompt, user-facing print, or explanatory comment/docstring describing the side effect. The script also proceeds to perform self-healing actions automatically, so the file-system modification is not clearly disclosed to the user at the point of action.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function restarts the openclaw gateway via systemctl or CLI, which is a potentially disruptive system operation. Although failures and outcomes are recorded in internal details, there is no clear user-facing warning, confirmation, or explanatory comment that the script may restart a service as part of self-healing.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This function actively contacts remote agents using `openclaw agent` and transmits a message payload, but the script provides no warning or explanatory comment that it will send probe messages to configured agents. Because this transmits data to external components, it should be disclosed somewhere in the code or user-facing output.

Static analysis

No suspicious patterns detected.