gateway
Manages the joelclaw gateway daemon for event handling and notifications, ensuring seamless communication and system health monitoring.
Install this skill
or
50/100
Security score
The gateway skill was audited on Jun 8, 2026 and we found 10 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
medium line 12
Webhook reference - potential data exfiltration
SourceSKILL.md
| 12 | The gateway daemon is the always-on pi session that receives events from Inngest functions, Telegram, and webhooks. It's the system's notification and communication layer. |
medium line 247
Webhook reference - potential data exfiltration
SourceSKILL.md
| 247 | | `gateway.notify(type, payload?)` | Notifications (task done, webhook) | Origin session + central gateway | |
medium line 337
Webhook reference - potential data exfiltration
SourceSKILL.md
| 337 | - Skill: [webhooks](../webhooks/SKILL.md) — inbound webhook providers |
medium line 35
Access to hidden dotfiles in home directory
SourceSKILL.md
| 35 | Use the CLI. Do not hand-edit `~/.joelclaw/scripts/gateway-start.sh` unless the CLI is broken. |
medium line 44
Access to hidden dotfiles in home directory
SourceSKILL.md
| 44 | The CLI blanks/restores the channel env assignments in `~/.joelclaw/scripts/gateway-start.sh`, writes a `/tmp/joelclaw/gateway-start.sh.*` backup before changes, and can restart the gateway when `--re |
medium line 279
Access to hidden dotfiles in home directory
SourceSKILL.md
| 279 | | Important Slack channels are not being collected | `SLACK_IMPORTANT_CHANNEL_IDS`/`SLACK_IMPORTANT_CHANNEL_NAMES` missing or channel IDs drifted | Check private `~/.joelclaw/scripts/gateway-start.sh` |
medium line 302
Access to hidden dotfiles in home directory
SourceSKILL.md
| 302 | The gateway reads `~/.pi/agent/` at boot for identity/prompt context (SOUL.md, AGENTS.md, MEMORY.md, daily log), but the **gateway extension itself is context-local**: |
medium line 305
Access to hidden dotfiles in home directory
SourceSKILL.md
| 305 | - Active path: `~/.joelclaw/gateway/.pi/extensions/gateway` (symlink) |
medium line 306
Access to hidden dotfiles in home directory
SourceSKILL.md
| 306 | - Do **not** install/restore `~/.pi/agent/extensions/gateway` globally |
medium line 323
Access to hidden dotfiles in home directory
SourceSKILL.md
| 323 | | `~/.joelclaw/scripts/gateway-start.sh` | launchd start script | |
Scanned on Jun 8, 2026
View Security Dashboard