Restart Safe Workflow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:31 AM UTC
• Version: 1.0.3

Overview

This skill is a real restart workflow, but it exposes unsafe shell execution and detached runner behavior that could run unintended commands with the user's OpenClaw privileges.

Review before installing. Use only in a trusted local OpenClaw environment, avoid untrusted --next values, task plan files, task IDs, notification arguments, ACTION_ALLOWLIST_FILE, and GATEWAY_RESTART_CMD, and prefer removing cmd:/script: execution or replacing bash -lc with strict argument-array execution before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restart-safe.sh:572

Finding

Arbitrary Command Execution Through Prefix-Based Command Allowlist Bypass

Content

View full analysis

/tmp/restart-action-${task_id}-${action_id}.out 2>&1 || { log "续跑 command 执行失败(actionId=$action_id): $action_cmd" return 1 } log "续跑 command 成功(actionId=$action_id): $action_cmd" ;; ``` ### Technical Analysis The command allowlist performs only a string-prefix comparison. The built-in rules similarly accept every string beginning with values such as `echo ` or `date`. The entire accepted value is subsequently passed to `bash -lc`, which parses shell separators, pipelines, substitutions, redirections, and other shell syntax. Consequently, an untrusted command can begin with an allowed prefix and append arbitrary operations using syntax such as: ```bash echo allowed; id > command-execution-proof ``` This value matches the bu ...[truncated 1621 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restart-safe.sh:596

Finding

Arbitrary Command Execution Through Script-Path Shell Injection

Content

View full analysis

/tmp/restart-script-${task_id}-${action_id}.out 2>&1 || { log "续跑 script 执行失败(actionId=$action_id): $action_path" return 1 } log "续跑 script 成功(actionId=$action_id): $action_path" ;; ``` ### Technical Analysis The script validator accepts any string beginning with either of two approved directory prefixes. It rejects only strings containing `..`; it does not require the value to be a single canonical path and does not reject shell syntax. The accepted string is passed directly to `bash -lc`. Therefore, shell separators and expansions are interpreted as commands rather than as part of a literal path. For example: ```bash skills/restart-safe-workflow/scripts/nonexistent; id > script-execution-proof ``` This string: - Starts with an allowed directory prefix. - Does not contain `..`. - Is accepted by `is_allowed_script`. - Causes the shell to attempt the first path and then execute the appended `id` command. Because the final command can return successfully, the action may also be recorded as successful despite the intended script not existing. ### At ...[truncated 1103 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restart-safe.sh:1198

Finding

Detached Restart Runner Command Injection Through Unescaped Task Identifier

Content

View full analysis

"$log_file" 2>&1 < /dev/null & pid="$!" state_update "$task_id" "restarting" "detached-runner-started" "{\"runnerPid\":\"$pid\",\"runnerLog\":\"$log_file\",\"restartIssued\":true}" log "已启动 detached runner: pid=$pid log=$log_file" } ``` ### Technical Analysis The task identifier is accepted from the `--task-id` command-line option and is interpolated into a command string passed to `bash -lc`. The code attempts to quote the value with single quotation marks, but embedded single quotes are not escaped and no safe-character validation is applied. A task identifier such as: ```text test'; id > detached-execution-proof; # ``` terminates the quoted task-ID argument and introduces additional shell syntax. The resulting shell source is structurally equivalent to: ```bash ... continue --task-id 'test'; id > detached-execution-proof; #' ``` The working directory and script path are also serialized into shell source. Although they are usually locally derived, eliminating the shell is necessary to avoid quoting-dependent security. This issue is reached by the default detached restart path; `--inline` is not required. ### Attack Path 1. An attacker or untrusted caller invokes the workflow using a crafted task ID: ```bash script ...[truncated 1033 chars]

Remediation

View remediation

"$log_file" 2>&1 < /dev/null & ) ``` 2. Validate task identifiers before using them in filenames or process arguments. A conservative policy is: ```text ^[A-Za-z0-9._-]+$ ``` 3. Impose a reasonable maximum identifier length. 4. Reject path separators, control characters, whitespace, shell metacharacters, and leading-dot edge cases where they are not explicitly needed. 5. Use the same task-ID validation consistently in `run`, `continue`, `resume-run`, `report`, `diagnose`, `status`, and `reconcile`. 6. Add regression tests with embedded quotes, semicolons, newlines, substitutions, spaces, and redirection operators. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restart-acceptance.sh:52

Finding

Acceptance Runner Command Injection Through Unescaped Command-Line Options

Content

View full analysis

"$SELF_LOG" 2>&1 < /dev/null & echo "[DETACHED] acceptance runner started: pid=$! log=$SELF_LOG report=$REPORT_FILE" exit 0 fi ``` ### Technical Analysis Several values supplied through command-line options are interpolated into a single shell command: - `TASK_PREFIX` - `REPORT_FILE` - `NOTIFY_MODE` - `NOTIFY_CHANNEL` - `NOTIFY_TARGET` - `NOTIFY_ACCOUNT` The current working directory and script path are also embedded in the shell string. Single quotes are added around values, but embedded single quotes are not escaped. Therefore, a crafted value can terminate the intended quote and inject additional shell syntax. For example, a task prefix such as: ```text test'; id > acceptance-execution-proof; # ``` can escape from the quoted `--task-prefix` value when the script is run with `--with-restart`, causing `bash -lc` to execute the appended command. ### Attack Path 1. An attacker influences one of the acceptance script's command-line options. 2. The script is invoked with `--with-restart`; detached mode is enabled by default. 3. The outer script reaches the detached self-runner branch. 4. The attacker-controlled value is concatenated into the command passed to `bash -lc`. 5. An embedded quote ends the int ...[truncated 806 chars]

Remediation

View remediation

"$SELF_LOG" 2>&1 < /dev/null & ``` 2. Change directory outside the generated command rather than using `bash -lc "cd ..."`. 3. Apply a strict safe-character policy to `TASK_PREFIX`. 4. Validate notification modes against an exact enumeration such as `compact` or `verbose`. 5. Validate report paths according to the intended trust boundary and prevent unintended overwrites where appropriate. 6. Add regression tests using embedded quotes, semicolons, newlines, command substitutions, and redirection operators in every supported option. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose presents the workflow as a safe restart mechanism, but the behavior includes executing post-restart shell commands derived from task or next-action input, running scripts from filesystem paths, validating executable plans, and launching detached background execution. This mismatch is dangerous because operators may trust the skill as a bounded maintenance workflow while it actually exposes a broader execution surface that can be abused for command execution, persistence, or unauthorized follow-on actions.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- `SKILL.md`

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow accepts --next cmd: and task-plan command actions, then later executes them with bash -lc. Although there is an allowlist, this still expands a supposedly restart-safe workflow into a general command runner, and the allowlist itself can be broadened externally via ACTION_ALLOWLIST_FILE, making misuse or unsafe configuration materially dangerous.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises shell, file read, and file write behavior through its documented commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: downstream systems or users cannot easily tell what capabilities the skill expects, which increases the chance of over-privileged execution or unsafe invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file switches into Chinese for the main usage and capability documentation, which can force a specific language on users without opt-in. The policy allows locale constraints only when they are optional or clearly justified, neither of which is stated here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/restart-acceptance.sh (reported line 54)May include surrounding context.

sh

# 自守护模式：当启用真实重启时，默认先自我detached，避免调用会话在重启中断
if [ "$WITH_RESTART" = "true" ] && [ "$DETACH_ON_RESTART" = "true" ] && [ "$INTERNAL_RUN" != "true" ]; then
  SELF_LOG="${STATE_DIR}/acceptance-${TASK_PREFIX}.runner.log"
  nohup bash -lc "cd '$(pwd)' && '$0' --with-restart --task-prefix '$TASK_PREFIX' --report-file '$REPORT_FILE' --internal-run --notify-mode '$NOTIFY_MODE' ${NOTIFY_CHANNEL:+--notify-channel '$NOTIFY_CHANNEL'} ${NOTIFY_TARGET:+--notify-target '$NOTIFY_TARGET'} ${NOTIFY_ACCOUNT:+--notify-account '$NOTIFY_ACCOUNT'}" >"$SELF_LOG" 2>&1 < /dev/null &
  echo "[DETACHED] acceptance runner started: pid=$! log=$SELF_LOG report=$REPORT_FILE"
  exit 0
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/restart-safe.sh (reported line 1211)May include surrounding context.

sh

# 自守护模式：当启用真实重启时，默认先自我detached，避免调用会话在重启中断
if [ "$WITH_RESTART" = "true" ] && [ "$DETACH_ON_RESTART" = "true" ] && [ "$INTERNAL_RUN" != "true" ]; then
  SELF_LOG="${STATE_DIR}/acceptance-${TASK_PREFIX}.runner.log"
  nohup bash -lc "cd '$(pwd)' && '$0' --with-restart --task-prefix '$TASK_PREFIX' --report-file '$REPORT_FILE' --internal-run --notify-mode '$NOTIFY_MODE' ${NOTIFY_CHANNEL:+--notify-channel '$NOTIFY_CHANNEL'} ${NOTIFY_TARGET:+--notify-target '$NOTIFY_TARGET'} ${NOTIFY_ACCOUNT:+--notify-account '$NOTIFY_ACCOUNT'}" >"$SELF_LOG" 2>&1 < /dev/null &
  echo "[DETACHED] acceptance runner started: pid=$! log=$SELF_LOG report=$REPORT_FILE"
  exit 0
fi

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Validation explicitly permits tool_call actions even though the executor does not implement them and the skill's purpose is limited to safe restart orchestration. Allowing broader action types than the stated scope weakens trust boundaries and creates room for future unsafe expansion or confusion around what plans are considered valid.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

GATEWAY_RESTART_CMD is environment-controlled and executed via bash -lc, so anyone able to influence the environment can replace the intended restart with arbitrary shell commands. In an operational automation context, environment variables are often inherited from wrappers or CI jobs, which makes this a realistic command-injection and misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The help text documents support for cmd: and the implementation later runs those actions with bash -lc, allowing queued post-restart shell execution. This is a safety-relevant capability, but the command help does not warn users that --next or task plans may cause shell commands to be executed after restart.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The help text advertises script: support, and the script later executes approved paths via bash -lc. Because this can run external scripts affecting the local system, users should be clearly warned in the command description or usage text, but that warning is absent here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.