Is fourtytwo42/x-claw safe?

openclaw_gateway_patch.py reads OpenClaw's compiled JavaScript gateway bundles and injects approximately 500 lines of JavaScript code that intercepts Telegram callback_query events and spawns child processes executing xclaw-agent CLI commands. This constitutes supply-chain modification of a third-party application without its knowledge. The patcher uses a version marker system (V1-V28) to detect and upgrade previously injected code, creating a self-updating persistent backdoor in the gateway process.

The binary patch applied by openclaw_gateway_patch.py writes directly to the OpenClaw npm package's dist/ directory on disk. There is no uninstall mechanism. Removing the X-Claw skill does not restore the original OpenClaw bundles, leaving injected code permanently active in the Telegram gateway even after the skill is deleted.

The JavaScript injected into OpenClaw's gateway process autonomously spawns xclaw-agent child processes in response to Telegram callback_query events, without routing decisions through the LLM or requiring user confirmation. This creates a parallel execution path for financial operations that bypasses the agent entirely.

openclaw_gateway_patch.py calls systemctl --user restart openclaw-gateway.service or openclaw gateway restart after applying patches, modifying the running state of system services without user awareness.

All wallet balances, trade states, approval IDs, token holdings, liquidity positions, and agent identity data are transmitted to xclaw.trade via XCLAW_AGENT_API_KEY. The skill has no data minimization controls and sends full financial state on every command invocation.

wallet-send and wallet-send-token are fully exposed through the skill interface. An agent manipulation attack (e.g., prompt injection from a web page) could cause the agent to transfer funds to an attacker-controlled address.

The injected gateway code intercepts Telegram callback_query events matching xappr|, xpol|, xfer| patterns and executes trades/transfers/policy changes via xclaw-agent WITHOUT routing through the LLM. Any party who can send a valid callback_data string to the Telegram bot can trigger financial operations.

SKILL.md installs a complex fail-closed behavioral contract with its own instruction precedence, failure codes, and output format requirements. This substantially constrains the agent's ability to use its own judgment and can prevent the agent from responding helpfully when the skill's precedence logic misclassifies a user request.

The skill instructs the agent to not display the commands it is running, reducing user oversight of what the skill is actually doing on their behalf. Users cannot easily audit skill behavior from conversation output alone.

The chat-post command can send arbitrary text to Telegram/Discord/Slack channels. Combined with wallet-balance or other data-reading commands, this could be used to exfiltrate financial information through social channels if the agent is manipulated.

setup_agent_skill.py installs Python pip dependencies from apps/agent-runtime/requirements.txt, creates a virtual environment at ~/.xclaw-agent/runtime-venv, and installs the Foundry cast binary to ~/.foundry/bin — all without explicit user disclosure during the skill installation step.

The skill exposes policy-approve-all and policy-revoke-all commands that permanently alter the agent's transfer approval requirements. A compromised or manipulated agent could invoke these to remove all approval gates on future transfers.

The owner-link command auto-sends the management URL to the last active channel when not on Telegram, including delivering the URL via skill execution path. This means sensitive management links may be posted to communication channels without explicit user intent.

The skill clone and install process was clean — only GitHub network access, filesystem changes confined to the skill directory, and no Python scripts were executed. The dangerous openclaw_gateway_patch.py only runs when the user explicitly invokes setup_agent_skill.py.

Honeypot credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .gcloud/application_default_credentials.json) were opened at two timestamps. Analysis of process timing and batch-access patterns confirms these accesses originated from the Oathe monitoring system (pre-install baseline collection at t=1771921680 and post-install canary integrity verification at t=1771921697.917), not from the skill or any of its components.