ClawHub
Back to skill

Security audit

Gateway Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill describes a useful gateway monitor, but it tells users to run and optionally persist unreviewed code fetched from a mutable GitHub repository.

Review carefully before installing. Prefer a release that packages server.js, the LaunchAgent plist, and all runtime files in the skill artifact, or at least pins and verifies a specific commit. Avoid enabling the LaunchAgent until you have inspected exactly what it runs, and treat the dashboard as a local service with authority to read logs and control Gateway/LiteLLM operations.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Execution of Unpinned Code from a Mutable Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-22
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
# Clone the project
git clone https://github.com/yes999zc/gateway-monitor.git
cd gateway-monitor

# Run directly without dependencies
node server.js

Technical Analysis

The installation instructions clone the default branch of an external Git repository and immediately execute server.js. Neither an immutable commit nor a release tag, checksum, or cryptographic signature is specified.

The audited artifact contains only SKILL.md and skill.yaml; it does not contain the referenced server.js. Therefore, the effective executable payload cannot be reviewed from this artifact and may change after the Skill has been audited. A compromise of the repository, transfer of repository ownership, or malicious update to its default branch could cause future users to execute different code from the code originally intended.

Attack Path

  1. An attacker compromises the remote repository, its maintainer account, or another mechanism capable of changing its default branch.
  2. The attacker modifies server.js or another file loaded by it.
  3. A user follows the documented installation procedure without pinning a reviewed revision.
  4. git clone retrieves the attacker-controlled version.
  5. node server.js executes the modified payload with the invoking user's permissions.
  6. If the optional LaunchAgent installation is subsequently performed, the payload may also obtain recurring cross-session execution.

Impact Assessment

The remote code receives the operating-system permissions of the user who starts Node.js. Depending on those permissions and the unknown implementation, it could access user-readable files, gateway logs and configuration, local credentials available to the process, network services, and service-management interfa ...[truncated 446 chars]

Remediation
View remediation

Remediation Suggestions

  • Include all reviewed runtime source files in the distributed Skill artifact.
  • If remote retrieval remains necessary, pin installation to an immutable Git commit rather than the default branch.
  • Publish and verify a cryptographic checksum or signed release before execution.
  • Separate retrieval from execution so users can inspect and approve the downloaded files.
  • Document the exact reviewed commit and reject execution when the checked-out revision differs.
  • Apply restrictive filesystem and network permissions to the monitoring process and avoid exposing credentials through its environment unless strictly necessary.

T06 · System Persistence

Error
Location
SKILL.md:77
Finding

Persistent Execution Through an Unreviewed macOS LaunchAgent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-80
Vulnerability Type: System persistence
Risk Level: High

Vulnerable Code:

bash
# Use launchd hosting (recommended)
cp bin/ai.openclaw.gateway-monitor.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway-monitor.plist

Technical Analysis

These instructions copy and load a macOS user LaunchAgent. A LaunchAgent can execute beyond the installation session and may start automatically in later login sessions, depending on its property-list configuration.

Continuous background execution is related to the declared real-time monitoring functionality, and the mechanism is disclosed rather than hidden. However, persistence is not required for the documented manual use of node server.js, so it exceeds the minimum privileges and lifecycle necessary for basic dashboard operation. The documentation additionally describes persistent operation as the recommended method.

The referenced bin/ai.openclaw.gateway-monitor.plist is absent from the audited artifact. Its executable path, arguments, environment, restart policy, working directory, and event triggers therefore cannot be verified. Because the installation instructions first retrieve mutable remote content, the unreviewed LaunchAgent can potentially provide persistent execution to code that changed after audit.

Attack Path

  1. A user clones the mutable remote repository as instructed.
  2. The retrieved repository supplies bin/ai.openclaw.gateway-monitor.plist and the executable it references.
  3. The user copies the unreviewed plist into ~/Library/LaunchAgents.
  4. The user runs launchctl load, registering and starting the LaunchAgent.
  5. A malicious or compromised executable referenced by the plist runs under the user's account.
  6. Subject to the unknown plist settings, the process may restart automatically or execute again in subsequent login se ...[truncated 625 chars]
Remediation
View remediation

Remediation Suggestions

  • Keep persistent installation strictly optional rather than recommending it as the default setup.
  • Include the complete plist in the audited artifact.
  • Use a fixed, validated absolute executable path and avoid writable or ambiguous path resolution.
  • Pin and verify the executable before registering it with launchd.
  • Configure only the minimum required launch conditions; avoid unnecessary automatic restart behavior.
  • Run the monitor under a dedicated, least-privileged account where practical.
  • Document lifecycle and removal commands, including unloading the agent and deleting the plist.
  • Require explicit user confirmation that clearly explains cross-session execution before installation.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.yaml:12
Finding

Declared Runtime Entry Point Is Missing from the Audited Artifact

Content
View full analysis

Vulnerability Details

File Location: skill.yaml, lines 12-15
Vulnerability Type: Insecure Skill configuration and incomplete auditable packaging
Risk Level: Medium

Vulnerable Code:

yaml
build:
  output: server.js
  entry: server.js

Technical Analysis

The Skill metadata declares server.js as both its build output and runtime entry point, but the complete supplied directory contains only SKILL.md and skill.yaml. The declared executable is therefore missing from the artifact.

This mismatch prevents static verification of the Skill's actual implementation, including its documented log access, configuration restoration, Gateway restart, container control, local HTTP binding, authentication, and secret-redaction behavior. It also causes the instructions to rely on separately retrieved mutable code rather than a runtime payload covered by the Skill audit.

This finding does not by itself prove that server.js contains malicious code. The security defect is that the package metadata claims an executable that is unavailable for review, undermining provenance and making the declared functionality unverifiable.

Attack Path

  1. A user or platform reads skill.yaml and expects server.js to be the reviewed entry point.
  2. The file is not available in the distributed artifact.
  3. The user follows SKILL.md and obtains a replacement from the remote repository.
  4. That replacement may differ from the implementation associated with the reviewed Skill version.
  5. The substituted file executes with the user's permissions and may expose the sensitive management operations advertised by the Skill.

Impact Assessment

The mismatch weakens release integrity and prevents assurance that runtime behavior matches the documented functionality or audited version. When combined with the installation instructions, it enables an unreviewed external file to occupy the trusted entry-point role.

T ...[truncated 237 chars]

Remediation
View remediation

Remediation Suggestions

  • Package server.js, the LaunchAgent plist, and every required runtime asset in the audited release.
  • Ensure the build metadata references files that are actually present in the artifact.
  • Make the Skill version correspond to an immutable source revision and document that revision.
  • Add packaging checks that fail when a declared entry point or output file is absent.
  • Review the complete server implementation for endpoint authentication, CSRF protection, command injection, secret exposure, safe local binding, and authorization of restart, restore, and container-control operations.
  • Avoid substituting remotely fetched code for a missing packaged entry point.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# 使用 launchd 托管（推荐）
cp bin/ai.openclaw.gateway-monitor.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway-monitor.plist

# 手动后台运行

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# 使用 launchd 托管（推荐）
cp bin/ai.openclaw.gateway-monitor.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway-monitor.plist

# 手动后台运行

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# 使用 launchd 托管（推荐）
cp bin/ai.openclaw.gateway-monitor.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway-monitor.plist

# 手动后台运行
nohup node server.js > gateway-monitor.log 2>&1 &

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

launchctl load ~/Library/LaunchAgents/ai.openclaw.gateway-monitor.plist

手动后台运行

nohup node server.js > gateway-monitor.log 2>&1 &

text

## 更新日志

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description on L02 is written entirely in Chinese, but there is no indication that the skill is region-specific or that users can opt into this locale. This can violate language/locale policy because it imposes a specific language on users without documented justification or choice.

Content

No source excerpt is available for this finding.