ClawHub
Back to skill

Security audit

Restart Guard

Security checks for vulnerabilities and agentic risk

Overview

This restart skill has a legitimate operational purpose, but it can automatically restart infrastructure, run broadly configured local commands, and transmit credentials or notifications with insufficient scoping.

Review carefully before installing. Use only in a controlled OpenClaw environment, require explicit operator confirmation before restart, keep the gateway host loopback-only unless you fully trust the remote endpoint, avoid arbitrary auth_token_env values, restrict diagnostics and verify commands to known OpenClaw commands, and protect ~/.openclaw/.env plus restart context files with strict permissions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/notify.py:105
Finding

Configurable remote gateway can receive arbitrary named secrets over plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/notify.py:145
Finding

Gateway and Telegram credentials are exposed through process command-line arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/guardian.py:746
Finding

Guardian diagnostics and postcheck context allow arbitrary non-shell command execution

Content
View full analysis
Remediation
View remediation
` - `openclaw health --json` 3. Resolve and compare the executable against the trusted `openclaw` binary path. 4. Reject arbitrary executable paths, interpreters, network clients, file-management utilities, and unsupported arguments. 5. Bound all numeric arguments and reject extra positional or option arguments. 6. Treat context and configuration files as security-sensitive: - Require regular files. - Reject symlinks. - Verify current-user ownership. - Require restrictive permissions. 7. If extensibility is required, add a separate explicit unsafe mode with clear confirmation rather than enabling arbitrary commands by default. 8. Add tests showing that commands such as Python interpreters, file utilities, and network clients are rejected even when they contain no shell metacharacters. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/restart.py:90
Finding

Predictable shared temporary lock permits symlink-based file overwrite

Content
View full analysis
= max_failures and not args.force: die(f"Consecutive failures ({failures}) >= max ({max_failures}). Manual intervention required.") try: with open(lock_path, "w", encoding="utf-8") as f: f.write( json.dumps( { "pid": os.getpid(), "restart_id": restart_id, "started_at": iso_now(), "reason": args.reason, "origin_session_key": origin_session_key, "origin_source": origin_source, "notify_mode": notify_mode, }, ensure_ascii=False, ) ) except OSError as e: die(f"Cannot acquire lock: {e}") ``` The example configuration uses a globally predictable path: ```yaml paths: lock_file: "/tmp/restart-guard.lock" ``` ### Technical Analysis The main lock is opened with regular `open(..., "w")`, which follows symbolic links and truncates an existing target. It is not created atomically with exclusive or no-follow flags. Because the default path resides in shared `/tmp` and has a predictable name, another local user can attempt to create the path first as a symlink. The cooldown check does not validate file type or ownership. The `--force` option bypasses the existence and cooldown protection entirely. Some operating systems enable protections agai ...[truncated 932 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/restart.py:523
Finding

Authenticated HTTP restart path is unreachable and causes orchestrator failure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (72)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill advertised as an operational restart utility but apparently focused on parsing YAML/frontmatter and config structures creates a misleading trust boundary. In this context, the danger is not the parsing itself but that users and reviewers may underestimate the true implementation gap and approve a tool that lacks promised safeguards.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 21)May include surrounding context.

If a previous restart failed and the lock wasn't cleaned up:

bash
rm -f /tmp/restart-guard.lock

Or use --force flag with restart.py.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The helper accesses credentials from a predictable local secret file under the user's home directory. In a skill execution context, automatic credential harvesting from disk materially increases the risk of unauthorized secret use and downstream exfiltration through the notification channels defined later in the file.

Content

Scanner excerpt · scripts/notify.py (reported line 11)May include surrounding context.

python
def dotenv_get(key):
    env_path = os.path.expanduser("~/.openclaw/.env")
    if not os.path.isfile(env_path):
        return ""
    try:

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Reading credentials from ~/.openclaw/.env creates a plaintext secret dependency outside a managed secret store and broadens the attack surface to any local process or user that can read that file. In this skill, the token can authorize gateway restart actions, so compromise of the file could enable unauthorized service disruption or control.

Content

Scanner excerpt · scripts/restart.py (reported line 741)May include surrounding context.

python
def dotenv_get(key):
    env_file = os.path.expanduser("~/.openclaw/.env")
    if not os.path.isfile(env_file):
        return ""
    with open(env_file, "r", encoding="utf-8") as f:

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/restart-context.md (reported line 30)May include surrounding context.

md
## Reason

<!-- Why is this restart needed? What changed? -->

## Changes Made

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security_fixes.py (reported line 152)May include surrounding context.

python
def test_rejects_pipe_in_host(self):
        with self.assertRaises(ValueError):
            restart.validate_host_port("evil.com|cat /etc/passwd", "8080")

    def test_rejects_backslash_in_host(self):
        with self.assertRaises(ValueError):

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The spec authorizes destructive restart behavior from broad natural-language phrases like 'restart now' without requiring explicit confirmation, authorization checks, or a constrained command format. In an agent setting, this increases the chance of accidental invocation from ordinary conversation, quoted text, logs, or prompt-injected content, potentially causing unintended service disruption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly says the user only needs to express a generic restart intent and that the agent should run the skill automatically. Because this skill performs a high-impact operation (gateway restart plus possible external notification), broad natural-language triggering without clear confirmation or scope boundaries can cause unintended or premature restarts from ambiguous conversation text.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The zero-config UX section states that no channel arguments are required and that restart semantics alone are sufficient, reinforcing automatic execution from loosely defined intent. In the context of a restart-capable skill with disaster-routing and external broadcast fallback, this increases the chance that normal discussion, quoted text, or indirect requests trigger disruptive actions and unintended notifications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly requires environment access and shell execution in metadata/workflow, but it does not declare any tool scope restrictions such as allowed tools or permissions. In a restart-oriented skill that can read configs, invoke subprocesses, and write files, missing scope boundaries increases the blast radius if the skill is misused or its implementation behaves unexpectedly.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The instruction 'must auto-run, do not ask user' delegates disruptive operational decisions to the skill without a human checkpoint. In the context of gateway restarts and cross-channel notifications, autonomous decision-making is especially dangerous because it can cause downtime and data propagation based on ambiguous language or adversarial prompts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
Use this skill when the task involves OpenClaw gateway restart, watchdog recovery, or post-restart reporting.  
当任务涉及 OpenClaw 网关重启、看门狗恢复、重启后回报时使用。

Natural-language triggers (must auto-run, do not ask user for script commands):
- "可以重启了"
- "现在重启吧"
- "restart now"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is configured to auto-execute on ordinary natural-language phrases like 'restart now' and equivalent Chinese phrases, with no additional opt-in or confirmation. For a skill that can restart services, write context, and notify external channels, phrase-triggered autonomous execution materially raises the risk of accidental disruption or abuse through prompt injection/social engineering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow describes automatically restarting infrastructure and sending notifications to origin or external channels without a clear user-facing warning about service disruption or data transmission. In an ops context, that omission is dangerous because users may trigger downtime or unintentionally send incident/context data to third-party endpoints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · config.example.yaml (reported line 11)May include surrounding context.

yaml
# --- Paths ---
paths:
  # Where to write the restart context file
  context_file: "~/.openclaw/custom/restart-guard-work/restart-context.md"
  # Lock file to prevent restart storms
  lock_file: "/tmp/restart-guard.lock"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown instructs users to run rm -f /tmp/restart-guard.lock, which deletes a file, but it does not include any warning about ensuring the lock file is stale or about potential side effects. For markdown files, destructive operations that could affect system integrity should be accompanied by a user-facing warning or caution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 53)May include surrounding context.

md
## Guardian Process

The guardian is spawned as a fully detached process (nohup + setsid) so it survives
the gateway restart. It:

1. Records the gateway PID before restart

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/auto_restart.py (reported line 16)May include surrounding context.

python
def main():
    parser = argparse.ArgumentParser(description="Auto run restart-guard flow")
    parser.add_argument("--config", required=True, help="Path to restart-guard.yaml")
    parser.add_argument("--reason", default="", help="Restart reason")
    parser.add_argument("--note", default="", help="Additional note for context")

Static analysis

No suspicious patterns detected.