Install, update, run, and remove OpenClaw Gateway Monitor + Gateway Watchdog on macOS via LaunchAgent. Use when user asks to deploy one-click monitoring, rec...

This package mostly does what it advertises (create user LaunchAgents and run a local monitor), but there are several red flags you should consider before installing: - The monitor binary reads local files that may contain credentials (~/.openclaw/agents/main/agent/auth-profiles.json) and also accepts an env var MINIMAX_CP_KEY; those secrets could be used in outbound requests. The SKILL metadata does not disclose needing or using credentials. - The server code performs outbound HTTPS requests to an external domain (MINIMAX_REMAINS_URL). If a local API key is included, it could be sent externally. If you do not trust the skill source, do not run it on a machine holding sensitive credentials. - install.sh references launchagent template files that are not present in the provided manifest; the installer may fail or behave unpredictably. Inspect the templates (assets/launchagents/*.plist.tpl) before running — they determine what gets launched and with what environment. - The monitor opens a local HTTP UI on 127.0.0.1:18990. Although localhost-only, any local user/process could query it; review what endpoints expose logs or status before trusting it with sensitive systems. Recommended actions: - Inspect the full gateway-monitor-server.js (and any truncated parts) to confirm exactly what data is collected and what outbound requests are made. - Verify or obtain the missing LaunchAgent templates and review them to ensure no unexpected environment or network configuration is injected. - Run the installer in an isolated account or VM first, or at minimum set firewall rules to block outbound connections and unset MINIMAX_CP_KEY to avoid leaking local keys. - If you need only a watchdog, consider extracting/rewriting a minimal watchdog script that does not read auth profiles or perform external network calls. Given the secrets-access pattern and the mismatch between declared requirements and actual file/env access, proceed only if you trust the source and have audited the code and templates; otherwise treat this skill as untrusted.

Type: OpenClaw Skill Name: gateway-monitor-installer Version: 1.0.0 The bundle installs persistent macOS LaunchAgents and a Node.js monitoring server that reads sensitive credentials from 'auth-profiles.json' to query the MiniMax API (minimaxi.com). A significant security vulnerability exists in 'gateway-monitor-server.js' where the '/api/restore-config' endpoint performs a state-changing filesystem operation (overwriting the main configuration with a backup) via a simple GET request. While these capabilities are aligned with the stated purpose of gateway monitoring and self-healing, the combination of persistence, credential access, and insecure API design warrants a suspicious classification.