Back to skill
Skillv1.0.0
ClawScan security
Teleport Machine ID tbot Bootstrap (MacOS LaunchAgent) · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 7:27 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files and runtime instructions consistently implement a macOS LaunchAgent bootstrap for Teleport tbot identity refresh; the requested inputs and filesystem changes match the stated purpose and there is no unexplained network exfiltration or unrelated credential access.
- Guidance
- This skill appears to do what it says: it will create ~/.openclaw/workspace/tbot, write tbot config/state and identity files, place a LaunchAgent plist in ~/Library/LaunchAgents, and start the agent. Before installing: (1) verify tbot and tsh are official Teleport binaries and come from a trusted source, (2) be prepared to provide the bot onboarding token or registration secret and understand those values and the produced identity files are sensitive (do not commit them to source control), (3) review the included script and plist contents to confirm file paths and labels meet your policy, and (4) if you do not want a persistent background process, do not load the LaunchAgent or remove it after testing. If you need higher assurance, run the script in a controlled test account first and rotate the onboarding token after setup.
Review Dimensions
- Purpose & Capability
- okName/description, SKILL.md, and the included script all focus on bootstrapping a persistent Teleport Machine ID (tbot) on macOS via a user LaunchAgent. Required binaries (tbot, tsh) and inputs (proxy, token or registration secret) align with that purpose; there are no unrelated binaries, services, or credentials requested.
- Instruction Scope
- noteInstructions and the script perform the expected operations: create ~/.openclaw/workspace/tbot and state dirs, run 'tbot configure identity' with provided token/registration-secret, write a LaunchAgent plist to ~/Library/LaunchAgents, bootstrap it, and run a tsh smoke test. This stays within the stated scope. Important note: the workflow writes tbot config/state and identity files to disk (and may embed or use onboarding tokens) — these are sensitive artifacts and the SKILL.md correctly warns about treating them as secrets.
- Install Mechanism
- okNo install spec is present (instruction-only with a helper script). Nothing is downloaded from remote URLs or installed automatically; the script expects tbot and tsh to already be present. This is low-install-risk and consistent with the skill's goal.
- Credentials
- noteNo environment variables or external credentials are declared by the registry metadata. The script requires a proxy address and either a token or registration secret provided at runtime — these are necessary for Teleport onboarding. Because the token/registration-secret are sensitive, the user should be aware they will be used during configuration and their values (or derived identity files) will be written to local files.
- Persistence & Privilege
- okThe skill intentionally creates and loads a user LaunchAgent under ~/Library/LaunchAgents to persist tbot. It does not request system/root (LaunchDaemon) installation, does not modify other skills or system-wide agent settings, and 'always' is not set. This persistence level is consistent with the stated purpose.