OpenClaw Mobile Gateway Installer

Installs and manages OpenClaw mobile gateway as a system service. Invoke when users need one-command deploy, start, stop, upgrade, or uninstall.

Before installing, consider the following: (1) The package requires OPENCLAW_API_BASE_URL and (optionally) an auth token, but the registry metadata did not declare those—treat that as a red flag. (2) The installer writes the auth header value to /etc/openclaw-mobile-gateway/env; verify file permissions and consider avoiding embedding long-lived secrets in a world-readable file. (3) The backend exposes many admin endpoints and appears to load ~/.openclaw/openclaw.json and runtime skill directories — it can therefore access local OpenClaw config and any API keys stored there. (4) The code imports child-process execution (execFileSync) — confirm how it is used and whether any exposed endpoint can trigger arbitrary command execution. (5) The service listens on the configured PORT (defaults to 4800) and is intended to be reachable externally (APK URL example); ensure network exposure is restricted (firewall, binding to localhost, or run behind a reverse proxy with auth). (6) Recommended actions: audit the backend code (services.ts) especially uses of execFileSync and any endpoints that mutate system state; run the installer in an isolated VM/container first; set a dedicated unprivileged RUN_USER and tighten /etc/openclaw-mobile-gateway/env permissions; set up authentication (securityConfig) before exposing to untrusted networks; update registry metadata to declare required envs so users know what secrets will be needed. If you cannot audit the code, avoid installing it on sensitive/production hosts.

Type: OpenClaw Skill Name: openclaw-mobile-gateway-installer Version: 1.0.4 The bundle installs a system-level gateway service that manages OpenClaw instances via a Node.js backend. While the behavior aligns with the stated purpose, it exhibits high-risk capabilities, including extensive use of 'sudo' in 'install.sh' and 'check.sh' to manipulate systemd services and environment files. The backend ('services.ts') uses 'execFileSync' to execute shell commands like 'systemctl', 'journalctl', and the 'openclaw' CLI based on API requests, which could lead to privilege escalation or unauthorized system control if the API is exposed without proper authentication.