ClawHub
Back to skill

Security audit

Idle-shutdown

Security checks for vulnerabilities and agentic risk

Overview

This skill openly installs a persistent idle watcher for OpenClaw Gateway, but its automatic shutdown logic can ignore some active sessions and stop the gateway unexpectedly.

Review this before installing on any shared, production, or business-critical Gateway. It will create a persistent user service that can automatically stop OpenClaw Gateway, and the current session-file filtering may shut it down even while some sessions are still active. Install only if you are comfortable with that availability risk and can remove the service if it behaves unexpectedly.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:43
Finding

Persistent User-Level Systemd Watcher

Content
View full analysis
~/.config/systemd/user/openclaw-idle-watch.service << 'EOF' [Unit] Description=OpenClaw idle gateway shutdown watcher After=openclaw-gateway.service BindsTo=openclaw-gateway.service PartOf=openclaw-gateway.service [Service] Type=simple ExecStart=%h/.openclaw/workspace/scripts/idle-shutdown.sh Restart=on-failure RestartSec=10s Environment=HOME=%h # Adjust this PATH if your openclaw binary lives elsewhere Environment=PATH=%h/.local/bin:%h/bin:/usr/local/bin:/usr/bin:/bin Environment=OPENCLAW_BIN=openclaw [Install] WantedBy=default.target EOF # 3. Enable and start the service systemctl --user daemon-reload systemctl --user enable openclaw-idle-watch.service systemctl --user start openclaw-idle-watch.service ``` ### Technical Analysis The installation instructions create, enable, and immediately start a user-level systemd service. Enabling the service causes it to survive the initial Skill run and execute automatically in future user sessions. The service continuously invokes the bundled watcher and uses `Restart=on-failure`, allowing systemd to restore it following abnormal failures. The `BindsTo` and `PartOf` relationships connect its lifecycle to the Gateway service. This persistence is documented as a feature rather than concealed. Nevertheless, it meets the system-persistence classification because following the installation instructions modifies persistent startup configuration and authorizes autonomous execution beyond the current invocation. ### Attack Path 1. A user follows the installation instructions in `SKILL.md`. 2. The watcher script is copied into the user's OpenClaw workspace. 3. A service definition is written to `~/.config/systemd/user/openclaw-idle-watch.service`. 4. `systemctl --user enable` reg ...[truncated 874 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/idle-shutdown.sh:39
Finding

Preferred Filename Filtering Can Ignore Active Sessions and Stop an In-Use Gateway

Content
View full analysis
/dev/null | sort || true)" if [ -n "$matches" ]; then printf '%s\n' "$matches" else find "$SESSIONS_DIR" -type f -print 2>/dev/null | sort || true fi } ``` The resulting timestamp is later used to stop the Gateway: ```bash if [ "$idle_for" -ge "$IDLE_SECONDS" ]; then log "all detected sessions idle for ${idle_for}s (threshold ${IDLE_SECONDS}s); stopping gateway" if "$OPENCLAW_BIN" gateway stop >> "$LOG_FILE" 2>&1; then log "gateway stop completed" exit 0 else rc=$? log "gateway stop failed (rc=$rc); retrying after ${POLL_SECONDS}s" fi fi ``` ### Technical Analysis The `session_files` function first searches for filenames containing `qqbot`, `channel`, or `direct`. If at least one such file exists, it returns only the preferred matches and excludes every nonmatching session file. Consequently, the subsequent `newest_session_mtime` calculation does not necessarily represent the newest timestamp across all sessions. This conflicts with the documented claim that the Gateway is stopped only when all sessions have been idle. For example, a stale file named `qqbot-session.json` causes preferred filtering to remain active while a currently updated file named `user-session.json` is ignored. The watcher calculates idleness from the stale file and may stop the Gateway despite ongoing activity in the nonmatching session. ### Attac ...[truncated 1396 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
systemctl --user stop openclaw-idle-watch.service
systemctl --user disable openclaw-idle-watch.service
rm ~/.config/systemd/user/openclaw-idle-watch.service
rm ~/.openclaw/workspace/scripts/idle-shutdown.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

systemctl --user stop openclaw-idle-watch.service systemctl --user disable openclaw-idle-watch.service rm ~/.config/systemd/user/openclaw-idle-watch.service rm ~/.openclaw/workspace/scripts/idle-shutdown.sh

text

## Service Lifecycle

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger words are overly broad for a skill that installs and manages a persistent systemd watcher capable of stopping a gateway service. Broad activation boundaries increase the chance the skill is invoked in unintended contexts, which can lead to unnecessary service changes or denial of service by shutting down the gateway when the user did not explicitly request installation or lifecycle management.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

Creating a systemd unit under ~/.config/systemd/user is a persistence mechanism because it places executable service configuration in the user's startup-managed service directory. Even though the purpose is administrative, this modifies the user's environment in a durable way and can be leveraged to keep background behavior running without repeated authorization.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
cp scripts/idle-shutdown.sh ~/.openclaw/workspace/scripts/
chmod +x ~/.openclaw/workspace/scripts/idle-shutdown.sh

# 2. Create the systemd service file
mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/openclaw-idle-watch.service << 'EOF'
[Unit]

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

Enabling a user systemd service establishes persistence across future user sessions, changing the host's long-term behavior beyond the immediate task. In a skill context, this is security-relevant because it installs an autonomous watcher that can repeatedly stop the gateway without further prompting, which may surprise users or be abused for availability impact.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

3. Enable and start the service

systemctl --user daemon-reload systemctl --user enable openclaw-idle-watch.service systemctl --user start openclaw-idle-watch.service

text

Static analysis

No suspicious patterns detected.