by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: install user LaunchAgents, run a periodic health-check, and restore a golden OpenClaw config when needed. Before installing: 1) Inspect ~/.openclaw/backups/golden-config/openclaw.json to ensure it doesn't contain secrets you don't want duplicated or permanently retained. 2) Be aware the installer will create ~/Library/LaunchAgents/*.plist and run launchctl bootstrap/bootout commands (user-level, not system-wide). 3) If you enable Telegram notifications, the...详细分析 ▾
✓ 用途与能力
Name/description match what the package installs and instructs: macOS LaunchAgents for process keepalive, a periodic health-check script, log rotation, and golden-config restore. The required files and the actions (copying configs, using launchctl, checking port 18789) are consistent with providing an auto-recovery/keepalive mechanism.
ℹ 指令范围
The runtime instructions and scripts operate on user home paths (~/.openclaw) and create user LaunchAgents under ~/Library/LaunchAgents. They read and write the OpenClaw config (copying current config to backups and restoring a golden config) and permanently append to a recovery-history log. This behavior is expected for an auto-recovery feature, but it does mean the skill will read/write potentially sensitive configuration files and preserve recovery history permanently unless removed.
✓ 安装机制
There is no external binary download; installation is script-driven (install.sh) that copies bundled scripts and writes launchd plist files. That is a low-to-moderate risk install pattern but coherent for this functionality—no remote URLs or extracted archives were used.
ℹ 凭证需求
The skill requests no global environment variables, but the installer optionally prompts for Telegram bot token and chat id which it stores in ~/.openclaw/config/keepalive.conf in plaintext. Given the functionality, storing/using those tokens is expected, but users should be aware tokens are stored locally and the scripts may send notifications to Telegram if configured.
ℹ 持久化与权限
The installer creates and loads user-level LaunchAgents and bootstraps them via launchctl so the health-check and gateway services run persistently. always:false is correctly set; the skill does not demand platform-wide 'always' privileges, but it will create persistent user-level services which will auto-run at user login/intervals.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.12026/3/8
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install gateway-keepalive
镜像加速npx clawhub@latest install gateway-keepalive --registry https://cn.longxiaskill.com