中文 EN
Start Review
Skill Trust Decision

gateway-monitor-installer

功能完整的 OpenClaw Gateway 监控安装工具，安装逻辑清晰、无恶意行为，但存在文档-实现差异（未声明 API 服务器和配置恢复功能）及 restore-config 端点可修改系统配置的隐患。

Install decision first Source: ClawHub Scanned: Apr 6, 2026
Files 6
Artifacts 3
Violations 3
Findings 4

Why this conclusion was reached

1/4 dimensions flagged
Block
Declared vs actual capability

3 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

3 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

文档-实现差异 +15

SKILL.md 仅声明安装/卸载，实际包含完整 API 服务器（gateway-monitor-server.js）、配置恢复等未声明功能

restore-config 端点 +10

/api/restore-config 可通过 HTTP 请求覆盖 ~/.openclaw/openclaw.json，无额外鉴权机制

本地 API 绑定 0.0.0.0 +5

服务器监听 0.0.0.0:18990 而非仅 localhost，扩展网络攻击面

Most important evidence

Medium Doc Mismatch

SKILL.md 未声明 API 服务器功能

SKILL.md 仅描述 install/uninstall/update 功能，但 gateway-monitor-server.js 实现完整的本地 API 服务器（监听 18990 端口），提供日志流、网关状态、会话上下文等 API 端点，属于明显的文档-行为差异。

SKILL.md:1
补全 SKILL.md 文档，声明实际包含的 API 服务器和所有端点功能。
Medium Priv Escalation

/api/restore-config 可修改系统配置文件

restore-config 端点允许通过 GET ?confirm=true 覆盖 ~/.openclaw/openclaw.json。虽然仅限于备份文件，但攻击者（如 XSS、本地网络窃听）可触发配置恢复，可能影响 Gateway 行为。

assets/bin/gateway-monitor-server.js:580
添加额外鉴权（如会话 token 检查）或限制为 localhost 来源。
Low Sensitive Access

读取 MiniMax 凭证配置文件

代码从 ~/.openclaw/agents/main/agent/auth-profiles.json 读取 API key 用于外部请求。凭证仅发送至 minimaxi.com，但端点响应中 keyMasked 会暴露脱敏 key。

assets/bin/gateway-monitor-server.js:215
确保本地 API 仅限受信任应用访问；考虑不在 API 响应中返回 keyMasked。
Low Priv Escalation

API 服务器监听 0.0.0.0 扩展攻击面

gateway-monitor-server.js 绑定 0.0.0.0:18990 而非 127.0.0.1，使同一网络内其他设备可访问本地 API。

assets/bin/gateway-monitor-server.js:700
考虑绑定 127.0.0.1 限制为本地访问，除非需要远程监控。

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
install.sh:22-24, gateway-monitor-server.js:restore-config
Shell Pass
Declared WRITE
→
Inferred WRITE
install.sh:50-54 launchctl commands
Network Block
Declared NONE
→
Inferred READ
gateway-monitor-server.js:MINIMAX_REMAINS_URL fetch
Environment Block
Declared NONE
→
Inferred READ
gateway-monitor-server.js:MINIMAX_CP_KEY env read
credential Block
Declared NONE
→
Inferred READ
gateway-monitor-server.js:MINIMAX_AUTH_PROFILE_PATH read

Suspicious artifacts and egress

Medium External URL
http://127.0.0.1:18990

SKILL.md:40

Medium External URL
https://www.minimaxi.com/v1/api/openplatform/coding_plan/remains

assets/bin/gateway-monitor-server.js:28

Medium External URL
http://127.0.0.1:18990/api/summary

scripts/status.sh:25

Dependencies and supply chain

There are no structured dependency warnings.

File composition

6 files · 1527 lines
JavaScript 1 files · 1321 linesShell 4 files · 159 linesMarkdown 1 files · 47 lines
Files of concern · 3
assets/bin/gateway-monitor-server.js JavaScript · 1321 lines
/api/restore-config 可修改系统配置文件 · 读取 MiniMax 凭证配置文件 · API 服务器监听 0.0.0.0 扩展攻击面 · https://www.minimaxi.com/v1/api/openplatform/coding_plan/remains
SKILL.md Markdown · 47 lines
SKILL.md 未声明 API 服务器功能 · http://127.0.0.1:18990
scripts/status.sh Shell · 28 lines
http://127.0.0.1:18990/api/summary
Other files · install.sh · gateway-watchdog.sh · uninstall.sh

Security positives

代码结构清晰，无混淆或隐藏执行逻辑
无 base64 编码、eval() 动态执行或反向 shell 等高危指标
launchctl 操作符合 macOS 系统管理规范
restore-config 仅操作备份文件，降低破坏风险
maskKey() 函数对 API key 进行脱敏处理
包含完整的错误处理和超时机制
使用 set -euo pipefail 强化 Shell 脚本安全性