Openclaw Health Guardian

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed OpenClaw health monitor that installs a user-level macOS background service, with some operational risk from automatic restarts and local cleanup commands.

Install only if you want a persistent background health service that can automatically repair and restart your OpenClaw Gateway. Review the script first, protect ~/.openclaw from unwanted edits, and prefer backing up logs/state before using the documented reset or uninstall deletion commands.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

• Location: scripts/install.sh:60
• Finding: Persistent User-Level LaunchAgent Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:60-98` **Vulnerability Type**: Persistent scheduled execution through a macOS LaunchAgent **Risk Level**: Medium ### Vulnerable Code ```bash cat > "$LAUNCH_AGENT_DIR/com.openclaw.healthcheck.plist" << EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.openclaw.healthcheck</string> <key>ProgramArguments</key> <array> <string>$USER_HOME/.openclaw/scripts/openclaw-health-check.sh</string> </array> <key>StartInterval</key> <integer>300</integer> <key>RunAtLoad</key> <true/> <key>StandardOutPath</key> <string>$USER_HOME/.openclaw/logs/health-check-daemon.log</string> <key>StandardErrorPath</key> <string>$USER_HOME/.openclaw/logs/health-check-daemon-error.log</string> <key>KeepAlive</key> <dict> <key>Crashed</key> <true/> <key>NonEmpty</key> <false/> </dict> <key>ProcessType</key> <string>Background</string> <key>ThrottleInterval</key> <integer>60</integer> </dict> </plist> EOF launchctl unload "$LAUNCH_AGENT_DIR/com.openclaw.healthcheck.plist" 2>/dev/null || true sleep 1 launchctl load "$LAUNCH_AGENT_DIR/com.openclaw.healthcheck.plist" ``` ### Technical Analysis The installer creates `~/Library/LaunchAgents/com.openclaw.healthcheck.plist` and immediately registers it with `launchctl`. The configuration executes the installed health-check script when loaded and every 300 seconds. It also asks launchd to relaunch the job after a crash. The persistence is directly related to the declared automatic monitoring functionality and remains within the current user's launchd domain. It does not request root privileges or create a system-wide daemon. Nevertheless, it survives the original Skill execution and continues invoking a m ...[truncated 2829 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make persistent installation explicitly opt-in: - Default to a manual health-check command. - Add an option such as `--install-launch-agent`. - Display the execution interval, persisted paths, and service-control capabilities before registration. 2. Request separate confirmation immediately before calling `launchctl load` or `launchctl bootstrap`. 3. Provide a monitoring-only mode that does not run `doctor --fix`, restart services, or open Terminal automatically. 4. Remove `KeepAlive` unless crash relaunching is operationally necessary. `StartInterval` already supplies periodic execution. 5. Minimize mutable execution dependencies: - Do not source `$HOME/.nvm/nvm.sh` from the background service. - Resolve the intended OpenClaw executable during installation. - Validate that the resolved executable is a regular file owned by the current user or a trusted package manager and is not group- or world-writable. - Store the validated absolute path in the LaunchAgent configuration or a protected configuration file. 6. Harden installed permissions: - Create directories with restrictive permissions. - Set the installed script to mode `0700` or `0755`, as appropriate. - Set state and log directories to mode `0700`. - Set the LaunchAgent plist to mode `0600` or another deliberately selected restrictive mode. 7. Clearly document that installation creates a cross-session background service capable of modifying OpenClaw configuration and restarting the Gateway. 8. Add a dedicated uninstall script that unloads or boots out the LaunchAgent before deleting it, and verifies that no health-check job remains registered. 9. Consider signing or hashing the installed payload and refusing execution if its integrity changes unexpectedly. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (72)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Stop and remove service
launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Remove scripts and logs
rm ~/.openclaw/scripts/openclaw-health-check.sh

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Remove scripts and logs
rm ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm ~/.openclaw/logs/health-check*.log
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove scripts and logs
rm ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm ~/.openclaw/logs/health-check*.log
```

• Confidence: 90% confidence
• Finding: Although the target is scoped to `~/.openclaw/state/`, use of `rm -rf` in documentation is still risky because shell expansion, symlink confusion, or user copy-editing mistakes can turn recursive deletion into a more destructive action. The surrounding skill context lowers suspicion of malicious intent, but unattended deletion commands remain dangerous in operational docs.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove scripts and logs
rm ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm ~/.openclaw/logs/health-check*.log
```

• Confidence: 90% confidence
• Finding: Although the target is scoped to `~/.openclaw/state/`, use of `rm -rf` in documentation is still risky because shell expansion, symlink confusion, or user copy-editing mistakes can turn recursive deletion into a more destructive action. The surrounding skill context lowers suspicion of malicious intent, but unattended deletion commands remain dangerous in operational docs.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove scripts and logs
rm ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm ~/.openclaw/logs/health-check*.log
```

## Requirements

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Wait for cooldown or force restart manually:
```bash
# Clear cooldown state
rm ~/.openclaw/state/last_restart

# Manual restart
openclaw gateway restart

• Confidence: 86% confidence
• Finding: Removing ~/.openclaw/state/last_restart changes control-flow state used for cooldown protection and may bypass safeguards designed to prevent restart thrashing. Although narrow in scope, it alters program behavior in a potentially unsafe way and should be treated as a risky manual override.

Memory Manipulation

High

• Category: Memory Poisoning

Content

grep -c "Starting OpenClaw health check" ~/.openclaw/logs/health-check.log

# If count is very high, there may be a loop
# Reset state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state
```

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# If count is very high, there may be a loop
# Reset state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state
```

• Confidence: 95% confidence
• Finding: The specific rm -rf ~/.openclaw/state/ command is an actual destructive filesystem operation. Context reduces the likelihood of malicious intent, but it remains hazardous because it force-deletes recursively without confirmation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# If count is very high, there may be a loop
# Reset state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state
```

• Confidence: 95% confidence
• Finding: The specific rm -rf ~/.openclaw/state/ command is an actual destructive filesystem operation. Context reduces the likelihood of malicious intent, but it remains hazardous because it force-deletes recursively without confirmation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

launchctl bootout gui/$(id -u)/com.openclaw.healthcheck 2>/dev/null

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

• Confidence: 94% confidence
• Finding: Deleting the LaunchAgent plist removes the service registration and can affect background operation or uninstall integrity if misapplied. The command is intended for uninstall, but it is still a potent file-deletion instruction that should be handled carefully.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

• Confidence: 94% confidence
• Finding: Deleting the health-check script removes executable logic required by the service and may hinder later recovery or forensic review. As written, the guide provides a forceful delete command without any backup or warning.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

# Verify removal

• Confidence: 96% confidence
• Finding: Recursive deletion of the state directory permanently removes application state and can destroy context needed to diagnose repeated failures. This is a true hazardous instruction despite benign intent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

# Verify removal

• Confidence: 96% confidence
• Finding: Recursive deletion of the state directory permanently removes application state and can destroy context needed to diagnose repeated failures. This is a true hazardous instruction despite benign intent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

# Verify removal
launchctl list | grep healthcheck  # Should be empty

• Confidence: 93% confidence
• Finding: Deleting health-check logs erases operational history and evidence that may be necessary for support, debugging, or incident review. In a troubleshooting document, removing logs without emphasizing the loss of diagnostics is unsafe.

Memory Manipulation

High

• Category: Memory Poisoning

Content

# Stop service
launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Clear state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Clear state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state

# Clear logs (optional)

• Confidence: 95% confidence
• Finding: This forceful state-directory deletion is a real destructive operation that can reset counters and behavior but also remove useful recovery data. The context is maintenance, not attack, yet the instruction is still dangerous enough to merit remediation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Clear state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state

# Clear logs (optional)

• Confidence: 95% confidence
• Finding: This forceful state-directory deletion is a real destructive operation that can reset counters and behavior but also remove useful recovery data. The context is maintenance, not attack, yet the instruction is still dangerous enough to merit remediation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

mkdir -p ~/.openclaw/state

# Clear logs (optional)
rm ~/.openclaw/logs/health-check*.log

# Restart service
launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

• Confidence: 91% confidence
• Finding: Removing log files during a 'reset all state' flow can erase records needed to understand ongoing faults. Because the guide encourages direct deletion, users may lose valuable evidence and troubleshooting context irreversibly.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

This skill is a **legitimate system monitoring tool** for OpenClaw Gateway health. It does not:

- ❌ Access external networks (only localhost:18789)
- ❌ Execute arbitrary code
- ❌ Access sensitive user data
- ❌ Use `eval` or dynamic code execution
- ❌ Require sudo/root privileges

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

**Status**: Expected behavior, documented here
- Only used when automatic recovery fails
- Displays diagnostic information to help user fix issues manually
- Does NOT execute arbitrary commands - just shows status output
- User must manually confirm any action in the opened terminal
- Pure notification mechanism, not automation

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and instructs shell execution and installation steps, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a consumer or orchestrator cannot easily constrain or review the shell capabilities the skill expects before use.

Session Persistence

Medium

• Category: Rogue Agent

Content

| `launchctl list \| grep openclaw` | Check service status |
| `tail -f ~/.openclaw/logs/health-check.log` | View real-time logs |
| `bash ~/.openclaw/scripts/openclaw-health-check.sh` | Manual check |
| `launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Stop service |
| `launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Start service |

## File Structure

• Confidence: 89% confidence
• Finding: The skill sets up a LaunchAgent plist under the user's LaunchAgents directory, establishing persistence across sessions. While persistence is expected for a health-monitoring daemon, it is still security-relevant because it causes code to run automatically and could be abused if the installed script or plist is modified.

Session Persistence

Medium

• Category: Rogue Agent

Content

| `tail -f ~/.openclaw/logs/health-check.log` | View real-time logs |
| `bash ~/.openclaw/scripts/openclaw-health-check.sh` | Manual check |
| `launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Stop service |
| `launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Start service |

## File Structure

• Confidence: 88% confidence
• Finding: Reference to the LaunchAgent plist at this line reinforces that the skill relies on a persistent macOS auto-start configuration. Persistence is not inherently malicious here, but unattended execution increases the consequences of any later script tampering or misconfiguration.

Session Persistence

Medium

• Category: Rogue Agent

Content

| `tail -f ~/.openclaw/logs/health-check.log` | View real-time logs |
| `bash ~/.openclaw/scripts/openclaw-health-check.sh` | Manual check |
| `launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Stop service |
| `launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Start service |

## File Structure

• Confidence: 88% confidence
• Finding: Reference to the LaunchAgent plist at this line reinforces that the skill relies on a persistent macOS auto-start configuration. Persistence is not inherently malicious here, but unattended execution increases the consequences of any later script tampering or misconfiguration.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── health-check-daemon-error.log # Daemon stderr

~/Library/LaunchAgents/
└── com.openclaw.healthcheck.plist  # LaunchAgent config
```

## Log Examples

• Confidence: 88% confidence
• Finding: The file structure shows a LaunchAgent plist stored under `~/Library/LaunchAgents`, which is a standard macOS persistence location. In this context it appears operational rather than malicious, but automatic startup remains a security-sensitive capability because it survives normal session boundaries.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/troubleshooting.md:111

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:141