OpenClaw Gateway Guardian

• Outcome: Review
• Latest audit: May 28, 2026 · 1:51 AM UTC
• Version: 1.1.1

Overview

This is a mostly coherent OpenClaw watchdog, but it can run persistently and automatically kill whatever process is using the configured gateway port.

Install only if you want a persistent local watchdog for OpenClaw. Before enabling auto-start, review or obtain the missing installer, consider disabling or fixing the force-kill-on-port behavior, protect the backup directory if your OpenClaw config contains secrets, and use only a trusted Feishu webhook.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if check_port_in_use(GATEWAY_PORT):
            kill_process_on_port(GATEWAY_PORT)
        
        proc = subprocess.Popen(
            ["openclaw", "gateway", "start"],
            cwd=OPENCLAW_DATA,
            stdout=subprocess.DEVNULL,

• Confidence: 93% confidence
• Finding: The process launch uses `shell=True` while passing a command resolved via the shell/PATH rather than an absolute trusted executable path. In this skill, the working directory and environment-derived paths are configurable, so a local attacker who can influence PATH, shell resolution, or deployment context may cause execution of an unintended program with the watchdog's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if len(parts) >= 5:
                    pid = parts[-1]
                    logger.warning(f"⚠️ Killing process {pid} on port {port}")
                    subprocess.run(['taskkill', '/F', '/PID', pid], capture_output=True)
                    time.sleep(2)
                    return True
        return False

• Confidence: 84% confidence
• Finding: This `taskkill` call consumes a PID parsed from `netstat` output without validating that the PID is numeric and actually belongs to the intended OpenClaw process. A parsing mistake or malicious environmental manipulation could cause termination of an unrelated service, creating a denial-of-service condition.

Tainted flow: 'OPENCLAW_DATA' from os.environ.get (line 63, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow

Content

if check_port_in_use(GATEWAY_PORT):
            kill_process_on_port(GATEWAY_PORT)
        
        proc = subprocess.Popen(
            ["openclaw", "gateway", "start"],
            cwd=OPENCLAW_DATA,
            stdout=subprocess.DEVNULL,

• Confidence: 90% confidence
• Finding: `OPENCLAW_DATA` is influenced by environment/config and is used as `cwd` for a subprocess that is launched with `shell=True`. That combination makes execution context attacker-influenceable: shell resolution and relative file behavior can be altered by choosing a malicious working directory or environment, increasing the chance of unintended code execution.

Tainted flow: 'config_file' from os.environ.get (line 318, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

return False
        
        config_file = Path(OPENCLAW_DATA) / "openclaw.json"
        with open(config_file, 'wb') as f:
            f.write(data)
        
        logger.info(f"✅ Config restored from: {backups[0]}")

• Confidence: 76% confidence
• Finding: The restore path writes decoded backup contents to a config file located under an environment/config-influenced directory without validating the target path. If the watchdog runs with higher privileges and an attacker can manipulate that path or filesystem links, this can become an arbitrary file overwrite primitive.

Tainted flow: 'config_file' from os.environ.get (line 318, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

logger.info(f"🔄 Switching model: {current} -> {FALLBACK_MODEL}")
                config['agents']['defaults']['model']['primary'] = FALLBACK_MODEL
                
                with open(config_file, 'w', encoding='utf-8') as f:
                    json.dump(config, f, indent=2)
                
                logger.info(f"✅ Model switched to: {FALLBACK_MODEL}")

• Confidence: 76% confidence
• Finding: This code rewrites `openclaw.json` at a path derived from environment/config without path validation. In hostile local environments or privileged deployments, path manipulation or link attacks could redirect the write to an unintended file, causing configuration tampering or overwrite.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet the documented behavior clearly requires shell execution, file read/write, environment expansion, and network access. This creates a trust and transparency problem: a user or platform may approve the skill under a lower-risk profile than its actual capabilities, enabling unexpected system modification, persistence, and outbound communication.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The stated purpose describes monitoring and restart behavior, but the document also indicates additional sensitive actions: sending Feishu notifications, creating persistence via scheduled tasks, restoring configuration, and potentially terminating processes on the gateway port. These extra behaviors expand the blast radius from simple monitoring into system management and external data transmission, which is materially more dangerous than the headline description suggests.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill advertises automatic restart, configuration backup/restore, webhook notifications, and boot persistence without clearly warning that it will modify the system, store copies of configuration, and send operational data externally. In this context, insufficient disclosure increases the chance of unintended privacy exposure, data retention, or disruptive changes to the host environment.

Static analysis

No suspicious patterns detected.