OpenClaw Rescue Instances

• Outcome: Review
• Latest audit: May 28, 2026 · 6:18 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-built for OpenClaw rescue gateways, but it creates persistent background services and includes an unsafe deletion path that users should review before installing.

Install only if you intentionally want macOS LaunchAgent services that keep OpenClaw gateways running in the background. Before use, add or require confirmation for delete operations, restrict instance names to a safe pattern like rescue plus digits, review copied OpenClaw config for credentials or account settings, and verify the hard-coded Node/OpenClaw paths match your machine.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly documents deletion of rescue instances and their configuration directories, but does not mention that this may irreversibly remove local state, credentials, sessions, logs, and agent data. In an agent setting, a user may issue a natural-language delete request and the skill could perform destructive actions without an explicit confirmation or backup step, causing avoidable data loss.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill describes creating isolated instance directories that include credentials, sessions, logs, and agent data, but does not warn users that sensitive material will be duplicated and persisted on disk per instance. This increases the attack surface and risk of credential exposure, especially on shared machines or when users assume the rescue instance is ephemeral.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✓ 配置文件：$RESCUE_DIR/openclaw.json"

# 3. 创建 LaunchAgent plist
PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$RESCUE_NAME.plist"
cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 89% confidence
• Finding: The script creates a macOS LaunchAgent plist that is configured with RunAtLoad and KeepAlive, causing the gateway process to persist across logins and automatically restart. Persistence mechanisms are security-relevant because they establish long-lived background execution, which could be abused if the service is exposed, misconfigured, or later compromised.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✓ 配置文件：$RESCUE_DIR/openclaw.json"

# 3. 创建 LaunchAgent plist
PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$RESCUE_NAME.plist"
cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

• Confidence: 89% confidence
• Finding: The script persists a background process using a LaunchAgent plist under the user's account. In the context of an agent skill, establishing background persistence is more sensitive than ordinary setup because it can leave a network-facing gateway continuously available after the script finishes.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✓ 配置文件：$RESCUE_DIR/openclaw.json"

# 3. 创建 LaunchAgent plist
PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$RESCUE_NAME.plist"
cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

• Confidence: 89% confidence
• Finding: The script persists a background process using a LaunchAgent plist under the user's account. In the context of an agent skill, establishing background persistence is more sensitive than ordinary setup because it can leave a network-facing gateway continuously available after the script finishes.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 3. 创建 LaunchAgent plist
PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$RESCUE_NAME.plist"
cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 88% confidence
• Finding: The plist body defines a persistent user service and is part of a complete autorun mechanism. This is not inherently malware, but it is a genuine persistence capability that warrants security review because it changes the host's execution model and may outlive the initiating session.

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$RESCUE_NAME.plist"
cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>

• Confidence: 88% confidence
• Finding: This is another match on the same plist-based persistence mechanism. While likely operationally motivated, repeatedly detected plist creation confirms the script intentionally installs a self-starting background service, which is a security-significant behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST_FILE="$HOME/Library/LaunchAgents/ai.openclaw.gateway-$RESCUE_NAME.plist"
cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>

• Confidence: 88% confidence
• Finding: This is another match on the same plist-based persistence mechanism. While likely operationally motivated, repeatedly detected plist creation confirms the script intentionally installs a self-starting background service, which is a security-significant behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > "$PLIST_FILE" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>ai.openclaw.gateway-$RESCUE_NAME</string>

• Confidence: 88% confidence
• Finding: The LaunchAgent label and surrounding plist content are part of a persistence mechanism that ensures continued execution. In this script's context, the service appears to be a 'rescue' gateway instance, so persistence may be intended, but it still increases risk by creating a durable background listener and restart behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

<string>2026.3.24</string>
    </dict>
  </dict>
</plist>
EOF
echo "✓ 服务文件：$PLIST_FILE"

• Confidence: 87% confidence
• Finding: The completed plist is written to disk and then referenced later for loading, meaning the persistence artifact is fully materialized on the host. A durable service definition in LaunchAgents can be abused or forgotten, leaving a long-running gateway active beyond the immediate rescue task.

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>
</plist>
EOF
echo "✓ 服务文件：$PLIST_FILE"

# 4. 加载并启动服务
launchctl load "$PLIST_FILE"

• Confidence: 91% confidence
• Finding: The script explicitly loads the LaunchAgent using launchctl, turning the plist into active persistence immediately. This is the most security-relevant part of the behavior because it transitions from mere configuration to a running, auto-restarting background service.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✓ 服务文件：$PLIST_FILE"

# 4. 加载并启动服务
launchctl load "$PLIST_FILE"
echo "✓ 服务已加载"

# 5. 等待启动并检查

• Confidence: 90% confidence
• Finding: This duplicate match corresponds to the same launchctl-based persistence activation. The behavior is genuine and security-relevant, even if intended for legitimate service management, because it leaves a continuously managed process on the host after the script exits.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✓ 服务文件：$PLIST_FILE"

# 4. 加载并启动服务
launchctl load "$PLIST_FILE"
echo "✓ 服务已加载"

# 5. 等待启动并检查

• Confidence: 90% confidence
• Finding: This duplicate match corresponds to the same launchctl-based persistence activation. The behavior is genuine and security-relevant, even if intended for legitimate service management, because it leaves a continuously managed process on the host after the script exits.

Static analysis

No suspicious patterns detected.