Install and operate a local OpenClaw Gateway Monitor stack on macOS with LaunchAgent + watchdog. Use when setting up, repairing, or validating gateway-monito...

This skill installs a persistent user-level launchd service that inspects OpenClaw logs and state, may read ~/.openclaw/agents/main/agent/auth-profiles.json, runs OpenClaw CLI commands, and by default contacts an external URL (MINIMAX_REMAINS_URL). Before installing: (1) review server.js fully (look for network requests, where data is sent, and whether auth-profiles.json is parsed/sent); (2) consider running the code in a sandboxed account or VM first; (3) if you must run on your machine, block outbound network access for the monitor (host firewall) or set MINIMAX_REMAINS_URL to an innocuous value/localhost; (4) inspect ~/.openclaw/agents/... for sensitive tokens and back them up/remove if you don't want local auth data read; (5) validate the upstream repository (README references a GitHub URL) and prefer sources you trust. If you cannot audit the server.js behavior yourself, treat the install as potentially exposing local OpenClaw credentials and externalizing runtime telemetry.

Type: OpenClaw Skill Name: gateway-monitor-macos Version: 1.1.1 The skill installs a persistent monitoring stack on macOS using LaunchAgents and a Node.js web server. While the functionality is aligned with the stated purpose of monitoring OpenClaw services, the implementation contains significant security risks: the server in `assets/gateway-monitor/server.js` binds to all network interfaces (`0.0.0.0`) and lacks any authentication mechanism. This allows anyone on the local network to access the dashboard, read sensitive system logs, view session metadata, and trigger administrative actions like service restarts or configuration restoration via the `/api/gateway-restart` and `/api/restore-config` endpoints. These vulnerabilities facilitate unauthorized information disclosure and remote service manipulation, though no evidence of intentional malicious exfiltration was found.