Openclaw Health Guardian

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed OpenClaw health monitor that installs a user-level macOS background service, with some operational risk from automatic restarts and local cleanup commands.

Install only if you want a persistent background health service that can automatically repair and restart your OpenClaw Gateway. Review the script first, protect ~/.openclaw from unwanted edits, and prefer backing up logs/state before using the documented reset or uninstall deletion commands.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

• Location: scripts/install.sh:60

Finding

Persistent User-Level LaunchAgent Installation

Content

View full analysis

"$LAUNCH_AGENT_DIR/com.openclaw.healthcheck.plist" << EOF Label com.openclaw.healthcheck ProgramArguments $USER_HOME/.openclaw/scripts/openclaw-health-check.sh StartInterval 300 RunAtLoad StandardOutPath $USER_HOME/.openclaw/logs/health-check-daemon.log StandardErrorPath $USER_HOME/.openclaw/logs/health-check-daemon-error.log KeepAlive Crashed NonEmpty ProcessType Background ThrottleInterval 60 EOF launchctl unload "$LAUNCH_AGENT_DIR/com.openclaw.healthcheck.plist" 2>/dev/null || true sleep 1 launchctl load "$LAUNCH_AGENT_DIR/com.openclaw.healthcheck.plist" ``` ### Technical Analysis The installer creates `~/Library/LaunchAgents/com.openclaw.healthcheck.plist` and immediately registers it with `launchctl`. The configuration executes the installed health-check script when loaded and every 300 seconds. It also asks launchd to relaunch the job after a crash. The persistence is directly related to the declared automatic monitoring functionality and remains within the current user's launchd domain. It does not request root privileges or create a system-wide daemon. Nevertheless, it survives the original Skill execution and continues invoking a m ...[truncated 2829 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (72)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

bash

# Stop and remove service
launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Remove scripts and logs
rm ~/.openclaw/scripts/openclaw-health-check.sh

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

rm ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

Remove scripts and logs

rm ~/.openclaw/scripts/openclaw-health-check.sh rm -rf ~/.openclaw/state/ rm ~/.openclaw/logs/health-check*.log

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although the target is scoped to ~/.openclaw/state/, use of rm -rf in documentation is still risky because shell expansion, symlink confusion, or user copy-editing mistakes can turn recursive deletion into a more destructive action. The surrounding skill context lowers suspicion of malicious intent, but unattended deletion commands remain dangerous in operational docs.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

Remove scripts and logs

rm ~/.openclaw/scripts/openclaw-health-check.sh rm -rf ~/.openclaw/state/ rm ~/.openclaw/logs/health-check*.log

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although the target is scoped to ~/.openclaw/state/, use of rm -rf in documentation is still risky because shell expansion, symlink confusion, or user copy-editing mistakes can turn recursive deletion into a more destructive action. The surrounding skill context lowers suspicion of malicious intent, but unattended deletion commands remain dangerous in operational docs.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

Remove scripts and logs

rm ~/.openclaw/scripts/openclaw-health-check.sh rm -rf ~/.openclaw/state/ rm ~/.openclaw/logs/health-check*.log

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

Remove scripts and logs

rm ~/.openclaw/scripts/openclaw-health-check.sh rm -rf ~/.openclaw/state/ rm ~/.openclaw/logs/health-check*.log

text

## Requirements

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

Removing ~/.openclaw/state/last_restart changes control-flow state used for cooldown protection and may bypass safeguards designed to prevent restart thrashing. Although narrow in scope, it alters program behavior in a potentially unsafe way and should be treated as a risky manual override.

Content

Scanner excerpt · references/troubleshooting.md (reported line 74)May include surrounding context.

Wait for cooldown or force restart manually:

bash

# Clear cooldown state
rm ~/.openclaw/state/last_restart

# Manual restart
openclaw gateway restart

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/troubleshooting.md (reported line 110)May include surrounding context.

grep -c "Starting OpenClaw health check" ~/.openclaw/logs/health-check.log

If count is very high, there may be a loop

Reset state

rm -rf ~/.openclaw/state/ mkdir -p ~/.openclaw/state

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The specific rm -rf ~/.openclaw/state/ command is an actual destructive filesystem operation. Context reduces the likelihood of malicious intent, but it remains hazardous because it force-deletes recursively without confirmation.

Content

Scanner excerpt · references/troubleshooting.md (reported line 111)May include surrounding context.

If count is very high, there may be a loop

Reset state

rm -rf ~/.openclaw/state/ mkdir -p ~/.openclaw/state

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The specific rm -rf ~/.openclaw/state/ command is an actual destructive filesystem operation. Context reduces the likelihood of malicious intent, but it remains hazardous because it force-deletes recursively without confirmation.

Content

Scanner excerpt · references/troubleshooting.md (reported line 111)May include surrounding context.

If count is very high, there may be a loop

Reset state

rm -rf ~/.openclaw/state/ mkdir -p ~/.openclaw/state

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Deleting the LaunchAgent plist removes the service registration and can affect background operation or uninstall integrity if misapplied. The command is intended for uninstall, but it is still a potent file-deletion instruction that should be handled carefully.

Content

Scanner excerpt · references/troubleshooting.md (reported line 147)May include surrounding context.

md

launchctl bootout gui/$(id -u)/com.openclaw.healthcheck 2>/dev/null

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Deleting the health-check script removes executable logic required by the service and may hinder later recovery or forensic review. As written, the guide provides a forceful delete command without any backup or warning.

Content

Scanner excerpt · references/troubleshooting.md (reported line 148)May include surrounding context.

md

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Recursive deletion of the state directory permanently removes application state and can destroy context needed to diagnose repeated failures. This is a true hazardous instruction despite benign intent.

Content

Scanner excerpt · references/troubleshooting.md (reported line 149)May include surrounding context.

md

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

# Verify removal

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Recursive deletion of the state directory permanently removes application state and can destroy context needed to diagnose repeated failures. This is a true hazardous instruction despite benign intent.

Content

Scanner excerpt · references/troubleshooting.md (reported line 149)May include surrounding context.

md

# Remove all files
rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

# Verify removal

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

Deleting health-check logs erases operational history and evidence that may be necessary for support, debugging, or incident review. In a troubleshooting document, removing logs without emphasizing the loss of diagnostics is unsafe.

Content

Scanner excerpt · references/troubleshooting.md (reported line 150)May include surrounding context.

md

rm -f ~/Library/LaunchAgents/com.openclaw.healthcheck.plist
rm -f ~/.openclaw/scripts/openclaw-health-check.sh
rm -rf ~/.openclaw/state/
rm -f ~/.openclaw/logs/health-check*.log

# Verify removal
launchctl list | grep healthcheck  # Should be empty

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/troubleshooting.md (reported line 164)May include surrounding context.

md

# Stop service
launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Clear state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This forceful state-directory deletion is a real destructive operation that can reset counters and behavior but also remove useful recovery data. The context is maintenance, not attack, yet the instruction is still dangerous enough to merit remediation.

Content

Scanner excerpt · references/troubleshooting.md (reported line 165)May include surrounding context.

md

launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Clear state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state

# Clear logs (optional)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This forceful state-directory deletion is a real destructive operation that can reset counters and behavior but also remove useful recovery data. The context is maintenance, not attack, yet the instruction is still dangerous enough to merit remediation.

Content

Scanner excerpt · references/troubleshooting.md (reported line 165)May include surrounding context.

md

launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

# Clear state
rm -rf ~/.openclaw/state/
mkdir -p ~/.openclaw/state

# Clear logs (optional)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Removing log files during a 'reset all state' flow can erase records needed to understand ongoing faults. Because the guide encourages direct deletion, users may lose valuable evidence and troubleshooting context irreversibly.

Content

Scanner excerpt · references/troubleshooting.md (reported line 169)May include surrounding context.

md

mkdir -p ~/.openclaw/state

# Clear logs (optional)
rm ~/.openclaw/logs/health-check*.log

# Restart service
launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SAFETY.md (reported line 8)May include surrounding context.

md

This skill is a **legitimate system monitoring tool** for OpenClaw Gateway health. It does not:

- ❌ Access external networks (only localhost:18789)
- ❌ Execute arbitrary code
- ❌ Access sensitive user data
- ❌ Use `eval` or dynamic code execution
- ❌ Require sudo/root privileges

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SAFETY.md (reported line 48)May include surrounding context.

md

**Status**: Expected behavior, documented here
- Only used when automatic recovery fails
- Displays diagnostic information to help user fix issues manually
- Does NOT execute arbitrary commands - just shows status output
- User must manually confirm any action in the opened terminal
- Pure notification mechanism, not automation

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs shell execution and installation steps, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a consumer or orchestrator cannot easily constrain or review the shell capabilities the skill expects before use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill sets up a LaunchAgent plist under the user's LaunchAgents directory, establishing persistence across sessions. While persistence is expected for a health-monitoring daemon, it is still security-relevant because it causes code to run automatically and could be abused if the installed script or plist is modified.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

| `launchctl list \| grep openclaw` | Check service status |
| `tail -f ~/.openclaw/logs/health-check.log` | View real-time logs |
| `bash ~/.openclaw/scripts/openclaw-health-check.sh` | Manual check |
| `launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Stop service |
| `launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Start service |

## File Structure

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Reference to the LaunchAgent plist at this line reinforces that the skill relies on a persistent macOS auto-start configuration. Persistence is not inherently malicious here, but unattended execution increases the consequences of any later script tampering or misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

| `tail -f ~/.openclaw/logs/health-check.log` | View real-time logs |
| `bash ~/.openclaw/scripts/openclaw-health-check.sh` | Manual check |
| `launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Stop service |
| `launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Start service |

## File Structure

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Reference to the LaunchAgent plist at this line reinforces that the skill relies on a persistent macOS auto-start configuration. Persistence is not inherently malicious here, but unattended execution increases the consequences of any later script tampering or misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

| `tail -f ~/.openclaw/logs/health-check.log` | View real-time logs |
| `bash ~/.openclaw/scripts/openclaw-health-check.sh` | Manual check |
| `launchctl unload ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Stop service |
| `launchctl load ~/Library/LaunchAgents/com.openclaw.healthcheck.plist` | Start service |

## File Structure

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The file structure shows a LaunchAgent plist stored under ~/Library/LaunchAgents, which is a standard macOS persistence location. In this context it appears operational rather than malicious, but automatic startup remains a security-sensitive capability because it survives normal session boundaries.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

└── health-check-daemon-error.log # Daemon stderr

~/Library/LaunchAgents/ └── com.openclaw.healthcheck.plist # LaunchAgent config

text

## Log Examples