OpenClaw Gateway Resilience Guard

• Outcome: Review
• Latest audit: May 28, 2026 · 8:31 AM UTC
• Version: 1.4.4

Overview

This is a real OpenClaw watchdog, but it installs a persistent local control service with broad command execution paths and weak dashboard token handling that users should review before installing.

Install only if you intentionally want a persistent OpenClaw watchdog that can restart Gateway and expose a localhost dashboard. Prefer installing with no auto-start first, review the generated config, disable dashboard actions unless needed, avoid custom command actions unless you fully control the config file, and review logs/exports before sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not command:
        return {"ok": False, "error": "empty command"}
    try:
        proc = subprocess.run(
            command,
            shell=True,
            cwd=str(STATE_DIR),

• Confidence: 98% confidence
• Finding: proc = subprocess.run( command, shell=True, cwd=str(STATE_DIR), text=True, capture_output=True, timeout=timeout,

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The README states the project 'does not handle message content' by default, but elsewhere documents an optional model probe that sends a real prompt through OpenClaw. Even if the feature is opt-in, this is still a security-relevant documentation inconsistency because operators may underestimate privacy, logging, billing, or data-flow exposure once the probe is enabled.

Scope Creep

High

• Confidence: 95% confidence
• Finding: The status/export APIs return large amounts of operational data including config values, file paths, logs, diagnostics, and action-state details. Although some secrets are masked, probe-related keys are explicitly exempted from masking and the endpoints expose sensitive local state to any process that can reach the localhost server.

Scope Creep

High

• Confidence: 99% confidence
• Finding: The server injects the live action token into index.html as JavaScript, making the control credential available to any script running in the page and to anyone who can fetch the page from localhost. Since that token authorizes restart/config actions, disclosure effectively collapses the protection model.

Scope Creep

Critical

• Confidence: 99% confidence
• Finding: The restart endpoint reads RESTART_COMMAND from configuration and executes it through the shell. This exceeds the documented permission of restarting OpenClaw Gateway and creates an arbitrary command-execution primitive if the config file is modified or attacker-controlled.

Scope Creep

Medium

• Confidence: 95% confidence
• Finding: The dashboard persists the action token in browser localStorage, making a privileged credential available across browser restarts and readable by any script running in the same origin. Because this token authorizes restart/configuration actions against the localhost watchdog API, token theft via XSS, malicious browser extensions, shared-user access, or local browser compromise can enable unauthorized control actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The diagnostic action supports executing an arbitrary command from configuration via `cmd.exe /c $Config.OpenClawDiagCommand`. This expands the skill from resilience monitoring into general command execution, so anyone who can modify the config can run arbitrary code in the user's context, which is broader than the declared capability and increases abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The restart path allows `RestartCommand` from configuration to be executed through `cmd.exe /c`, enabling arbitrary shell execution whenever restart logic is triggered. Because this code runs automatically in a watchdog loop and may be installed as a persistent scheduled task/service, a modified config can yield repeated unattended code execution in the user's session.

Scope Creep

High

• Confidence: 98% confidence
• Finding: The script allows OPENCLAW_DIAG_ACTION=command and then executes OPENCLAW_DIAG_COMMAND via `sh -c`. Because configuration is sourced from `watchdog.env`, anyone who can modify that file can achieve arbitrary command execution in the user's context, which exceeds the narrowly described restart/monitoring behavior.

Scope Creep

High

• Confidence: 98% confidence
• Finding: The model probe failure path executes MODEL_PROBE_COMMAND with `sh -c`, enabling arbitrary shell execution when probe failures occur. Since this behavior is driven by sourced configuration and not limited to the declared restart mechanisms, it creates a general-purpose code execution surface tied to network-triggerable conditions.

Scope Creep

High

• Confidence: 99% confidence
• Finding: RESTART_COMMAND is executed using `sh -c`, so the restart mechanism can run arbitrary shell code rather than only the declared `systemctl --user` or `openclaw gateway restart` actions. Because the config file is sourced, altering configuration can convert a watchdog restart feature into full user-context command execution.

Scope Creep

Medium

• Confidence: 89% confidence
• Finding: The installer accepts a user-supplied RestartCommand and persists it into the watchdog configuration, enabling later execution by the scheduled watchdog process. Although this appears intended for flexibility and recovery, it effectively creates a persistence path for arbitrary command execution that exceeds the narrowly described Windows restart behavior and becomes risky if the config is modified or the parameter is misused.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Injecting the token into browser-visible JavaScript is not just a UX warning issue; it materially exposes a credential to the client environment. In a localhost dashboard, browser extensions, injected scripts, or local malware can trivially read it and invoke privileged actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When the user enters the dashboard token, the code silently saves it to localStorage without a clear warning that the credential will persist in the browser. This increases the chance users leave a privileged action token stored on disk longer than intended, extending exposure to local compromise or script-based token theft.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script sources `watchdog.env` with `. "$CONFIG_FILE"`, which executes arbitrary shell syntax rather than merely reading key-value settings. If an attacker or another process can modify that file, they gain code execution whenever the watchdog starts, making this a direct command execution vulnerability.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The diagnostic action path explicitly supports arbitrary shell command execution from configuration, without strong guardrails. In this watchdog context, the command may run automatically after repeated diagnostic failures, so external conditions can indirectly trigger user-context code execution once configuration is poisoned or misused.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The installer creates a persistent config file containing a bearer-style dashboard token, but it does not set restrictive file permissions or warn the user that a secret is being stored on disk. In a multi-user system or misconfigured home directory, local users or backup/logging tooling could read the token and access the localhost dashboard's guarded actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

else
    echo "User systemd is not available. Installing direct-run fallback."
    if [ "$NO_START" -eq 0 ]; then
      nohup "${INSTALL_DIR}/gateway-watchdog.sh" >>"${STATE_DIR}/bootstrap.log" 2>&1 &
      printf '%s\n' "$!" >"${STATE_DIR}/watchdog.pid"
      echo "Started fallback process with PID $(cat "${STATE_DIR}/watchdog.pid")."
    fi

• Confidence: 67% confidence
• Finding: nohup

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: openclaw-plugin/openclaw.plugin.json:12