swarm-self-heal

WarnAudited by ClawScan on May 18, 2026.

Overview

The watchdog mostly matches its reliability purpose, but its setup can create recurring agent jobs that report to a hardcoded Telegram recipient if no local default is configured.

Before installing, inspect or edit scripts/setup.sh, set your own Telegram default recipient, and verify the created OpenClaw cron jobs. Only use this skill if you are comfortable with recurring watchdog agents and automatic OpenClaw gateway restarts.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

High

#ASI07: Insecure Inter-Agent Communication

What this means

Watchdog receipts and raw failure details could be sent to an unknown Telegram chat without the user explicitly choosing that recipient.

Why it was flagged

If the user's OpenClaw config has no Telegram default target, setup falls back to a hardcoded Telegram recipient and wires recurring announcements to it.

Skill content

if [[ -z "$target_to" ]]; then
  target_to="8563003761"
fi
...
--channel telegram \
--to "$target_to"

Recommendation

Fail closed when no Telegram target is configured, or require the user to provide an explicit destination before creating cron jobs.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user may trust the default Telegram routing without realizing alerts could go somewhere other than their own configured destination.

Why it was flagged

The documentation frames the fallback as safe, while the implementation uses a hardcoded numeric Telegram target that is not identified to the user.

Skill content

Telegram target is auto-derived from config when available, with a safe fallback.

Recommendation

Document the exact fallback behavior, remove the hardcoded recipient, and ask for confirmation before enabling Telegram delivery.

Low

#ASI10: Rogue Agents

What this means

The skill will continue running on a schedule after setup and may consume agent/runtime resources.

Why it was flagged

Setup creates or edits recurring primary and backup watchdog jobs, which is persistent autonomous behavior but is consistent with the watchdog purpose.

Skill content

openclaw cron add \
    --agent designer \
    --name "Anvil stuck watchdog" \
    --every 20m ...
openclaw cron add \
    --agent reviewer \
    --name "Swarm self-heal backup" \
    --every 30m

Recommendation

Review the created cron jobs after setup and disable or adjust them if you do not want recurring watchdog runs.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A run may briefly disrupt the local OpenClaw gateway while trying to recover service health.

Why it was flagged

The watchdog can restart the OpenClaw gateway as a recovery action; the artifacts disclose this and limit it to bounded restart attempts.

Skill content

systemctl --user restart openclaw-gateway ...
openclaw gateway restart

Recommendation

Use it only where automatic gateway restart is acceptable, and monitor the emitted actions and receipts.

Low

#ASI03: Identity and Privilege Abuse

What this means

It acts with your OpenClaw workspace privileges to change cron configuration and deliver notifications.

Why it was flagged

The skill uses the user's OpenClaw CLI authority to modify scheduled jobs and send announcements through a configured channel.

Skill content

openclaw cron edit "$primary_id" ... --announce --channel telegram --to "$target_to"

Recommendation

Confirm the OpenClaw account, agents, channel, and recipient before running setup.