Restart Guard

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:23 AM UTC
• Version: 2.2.0

Overview

This skill is not clearly malicious, but it can automatically restart an OpenClaw gateway and send status or diagnostics to external channels, so it needs careful review before installation.

Install only if you operate the OpenClaw gateway and want an agent to restart it on request. Review the config first, keep notification channels disabled unless needed, avoid generic webhooks unless you trust the destination, protect ~/.openclaw/.env, and require your own explicit confirmation process before allowing production restarts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

exec_args = shlex.split(actual)
            if not exec_args:
                raise ValueError("empty command after parsing")
            result = subprocess.run(
                exec_args,
                shell=False,
                capture_output=True,

• Confidence: 91% confidence
• Finding: Diagnostics commands are loaded from configuration and then executed as arbitrary processes after only a shallow metacharacter blacklist. Even with shell=False, this still permits execution of attacker-controlled binaries/arguments if an adversary can modify config, making it an unsafe arbitrary command execution surface in a privileged watchdog component.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for k, v in headers.items():
        cmd.extend(["-H", f"{k}: {v}"])
    cmd.extend(["-d", body, url])
    result = subprocess.run(cmd, capture_output=True, timeout=10)
    return result.returncode == 0

• Confidence: 77% confidence
• Finding: The generic webhook helper builds curl arguments from largely untrusted configuration, including method, headers, and URL. While this is not shell injection, it enables arbitrary outbound requests to attacker-chosen endpoints and can be abused for data exfiltration or SSRF-like access from the host running the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not exec_args:
                raise ValueError("empty command after parsing")

            proc = subprocess.run(
                exec_args, shell=False, capture_output=True, text=True, timeout=30,
            )
            output = proc.stdout.strip()

• Confidence: 94% confidence
• Finding: The script executes commands taken from the restart context frontmatter (`verify`) using `subprocess.run`. Although `shell=False` and a metacharacter block reduce classic shell-injection risk, the command content is still attacker-controlled if the context file can be influenced, so this becomes arbitrary program execution under the script's privileges. In an operational restart skill, that context is especially sensitive because it is likely generated or consumed during privileged maintenance workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares executable requirements and explicitly instructs use of shell commands, environment variables, and local file read/write behavior, but the metadata does not declare corresponding permissions in a user-visible way. This creates a trust and review gap: a user or platform may underestimate the skill's ability to restart infrastructure, persist context, and access secrets such as webhook tokens or auth tokens.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This restart-focused skill contains broad multi-channel outbound notification capabilities that extend beyond the narrow operational scope described in the manifest. That broader egress surface increases the chance of unintended disclosure of restart status, error details, or other sensitive messages to third-party services.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code supports arbitrary webhook delivery and generic channel passthrough, allowing messages to be routed to endpoints outside the restart-guard purpose. In a security-sensitive automation context, this materially increases exfiltration and policy-bypass risk because destination control is delegated to configuration without meaningful restriction.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: `trigger_restart_http()` returns immediately after host/port validation because the HTTP request logic is accidentally placed after `return` statements inside `validate_host_port()`. This silently disables the primary restart path, causing the tool to fall back to signal/CLI methods, which may behave differently and can produce unsafe or unexpected restart behavior.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The spec allows automatic execution of a disruptive restart from broad natural-language phrases like 'restart now' without requiring strong confirmation, authorization checks, or disambiguation. In an agent setting, this creates a real safety and security risk because casual conversation, prompt injection, quoted text, or indirect user content could unintentionally trigger service-impacting behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The specification automates gateway restart behavior but does not require a user-facing warning that the action is disruptive and may temporarily interrupt service. This increases the chance of unsafe or surprising execution, especially when combined with the broad trigger design, because users may not understand that a natural-language request will immediately cause downtime.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README explicitly says the user only needs to express broad restart intent such as 'restart now' and that the agent will run the restart flow automatically. For a high-impact action like restarting a gateway, this lowers the activation threshold and can cause unintended service disruption from ambiguous natural-language input, especially in conversational environments where intent can be inferred too loosely.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation promotes automatic restart plus proactive/external notification behavior but does not place a prominent warning near the activation text that this may interrupt service and send messages over external channels. In practice, an operator or agent may trigger the flow without appreciating the operational impact or data-disclosure implications of fallback notification routes.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad, conversational, and mapped to an irreversible operational action: restarting a gateway. Because the skill is configured to auto-run on ordinary language like 'restart now' or its Chinese equivalents, it can be invoked accidentally during normal discussion, quoted text, or ambiguous context, causing unintended service disruption.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow directs the agent to automatically restart the gateway, infer the origin session, discover external channels, and persist an effective notification plan without a clear user-facing warning or explicit consent for these system-impacting and data-handling actions. In context, this is more dangerous because it combines operational control with metadata persistence and outbound notification routing, which can expose session identifiers or route sensitive diagnostics to unintended destinations.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The helper transmits message content and an authorization token to the gateway over HTTP without any visible user-facing disclosure in the code path. Even if this is expected behavior, silent transmission of operational content and credentials can surprise operators and increase accidental leakage risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Telegram notifications send message content to a third-party service using a bot token, but the code provides no visible disclosure or consent mechanism. In practice this can leak restart events, host details, or error messages to external infrastructure without adequate operator awareness.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Discord webhook delivery sends message content to an external endpoint without any visible user disclosure in this code. This creates a data-leakage risk if operational messages contain sensitive environment or incident details.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Slack webhook delivery transmits message content externally without any visible disclosure or guardrails. Restart and error notifications often contain contextual details that may be sensitive in production environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The generic webhook path can send arbitrary message content to configured external endpoints with customizable headers and body format, yet there is no visible disclosure or approval flow. This combination makes accidental or intentional exfiltration significantly more dangerous than fixed integrations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script copies configuration and writes restart state to predictable filesystem locations under the user's home/work directories without setting restrictive permissions. These files may contain session identifiers, operational metadata, or config secrets, and could be readable by other local users depending on umask and directory permissions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"-sS",
            "-X",
            "POST",
            f"https://api.telegram.org/bot{token}/sendMessage",
            "-d",
            f"chat_id={chat_id}",
            "--data-urlencode",

• Confidence: 84% confidence
• Finding: This code explicitly transmits data to Telegram's external API. In isolation that is normal for notifications, but in the context of a restart-guard skill it expands data egress to a third party and may expose operationally sensitive messages.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Use this skill when the task involves OpenClaw gateway restart, watchdog recovery, or post-restart reporting.  
当任务涉及 OpenClaw 网关重启、看门狗恢复、重启后回报时使用。

Natural-language triggers (must auto-run, do not ask user for script commands):
- "可以重启了"
- "现在重启吧"
- "restart now"

• Confidence: 90% confidence
• Finding: The instruction to 'must auto-run' and 'do not ask user' delegates a high-impact infrastructure decision to the skill without an approval checkpoint. In this context, autonomous execution is especially risky because the action is a gateway restart and may also trigger follow-on messaging and persistence behaviors, amplifying the consequences of a mistaken activation.

Unvalidated Output Injection

High

• Category: Output Handling

Content

exec_args = shlex.split(actual)
            if not exec_args:
                raise ValueError("empty command after parsing")
            result = subprocess.run(
                exec_args,
                shell=False,
                capture_output=True,

• Confidence: 89% confidence
• Finding: Command output from configured diagnostics is stored and later written into markdown and notification payloads, with only partial secret redaction. An attacker controlling the diagnostic command or its output could inject misleading content, exfiltrate sensitive local state into diagnostics artifacts, or abuse downstream consumers that render markdown/log text, especially because this watchdog automatically distributes failure details.

Unvalidated Output Injection

High

• Category: Output Handling

Content

for k, v in headers.items():
        cmd.extend(["-H", f"{k}: {v}"])
    cmd.extend(["-d", body, url])
    result = subprocess.run(cmd, capture_output=True, timeout=10)
    return result.returncode == 0

• Confidence: 74% confidence
• Finding: Although there is no shell injection, untrusted configuration controls request headers, method, URL, and body for the generic webhook sender. That creates a practical injection-of-output-into-external-protocols problem, enabling crafted outbound requests to arbitrary services and increasing exfiltration or internal-service access risk.

Credential Access

High

• Category: Privilege Escalation

Content

def dotenv_get(key):
    env_file = os.path.expanduser("~/.openclaw/.env")
    if not os.path.isfile(env_file):
        return ""
    with open(env_file, "r", encoding="utf-8") as f:

• Confidence: 91% confidence
• Finding: Reading secrets from `~/.openclaw/.env` creates a secondary credential source that may be less protected than dedicated secret stores, and the code performs no permission checks on that file before consuming it. If the file is readable or writable by other local users, an attacker could steal the gateway token or replace it to redirect privileged operations.

Session Persistence

Medium

• Category: Rogue Agent

Content

auth_token = os.environ.get(auth_token_env, "") or dotenv_get(auth_token_env)

    if not os.path.isfile(context_path) or os.path.getsize(context_path) == 0:
        die(f"Restart context missing or empty: {context_path}\nWrite context first (write_context.py)")
    if not oc_bin:
        die("Cannot find 'openclaw' binary. Set paths.openclaw_bin or ensure it is in PATH.")

• Confidence: 80% confidence
• Finding: This script persists restart context, origin session keys, notification plans, snapshots, and logs across runs, which creates durable state tied to sessions and operator activity. In this skill context, persistence is functional, but it becomes risky when stored in predictable local files without clear retention limits or access controls.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.