T09 · Insecure Skill Coding Practices
- Location
scripts/backup.sh:6- Finding
Sensitive backup archives are created without enforced access controls or encryption
- Content
View full analysis
Vulnerability Details
File Location:
scripts/backup.sh, lines 6–22
Vulnerability Type: Insecure storage of sensitive information
Risk Level: Mediumbash BACKUP_DIR="${1:-$HOME/openclaw-backups}" DATE="$(date +%Y-%m-%d_%H%M)" BACKUP_FILE="$BACKUP_DIR/openclaw-$DATE.tar.gz" mkdir -p "$BACKUP_DIR" if [ ! -d "$HOME/.openclaw" ]; then echo "Backup failed: $HOME/.openclaw not found" exit 1 fi # Create backup (exclude completions cache and logs) tar -czf "$BACKUP_FILE" \ --exclude="completions" \ --exclude="*.log" \ -C "$HOME" .openclaw/Technical Analysis
The script archives the entire
~/.openclawdirectory, excluding only completion caches and log files. According toSKILL.md, the resulting archive includes API keys, tokens, authentication profiles, Telegram session data, agent state, scheduled tasks, memory, configuration, and user files.Neither the backup directory nor the archive is assigned an explicit restrictive permission mode. Their permissions therefore depend on the invoking process's
umask. With a commonumaskof022, a newly created directory can be mode0755, while the archive can be mode0644. This may permit other local users to traverse the directory and read the archive.Gzip compression does not provide encryption. Consequently, backups copied to shared directories, network storage, removable media, or other insufficiently protected locations expose their contents in plaintext. The optional
backup_dirargument increases this risk because callers can select a location with weaker access controls.Attack Path
- A user runs
scripts/backup.shunder a permissiveumask, or selects a shared or weakly protected backup directory. - The script creates a gzip-compressed archive without enforcing owner-only permissions or encryption.
- A local user or another party with access to the backup storage locates the
openclaw-*.tar.gzfile. ...[truncated 1029 chars]
- A user runs
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive
umaskbefore creating any backup artifacts:bash umask 077 -
Create the backup directory with owner-only access and correct permissions on an existing directory:
bash install -d -m 700 -- "$BACKUP_DIR" chmod 700 -- "$BACKUP_DIR" -
Explicitly enforce owner-only permissions on the completed archive:
bash chmod 600 -- "$BACKUP_FILE" -
Prefer writing to a temporary archive created with secure permissions and atomically renaming it after successful completion. This prevents incomplete backup files from being treated as valid archives.
-
Encrypt archives with an authenticated encryption mechanism before storing them on shared, remote, removable, or otherwise untrusted storage. Keep encryption keys separate from the backups and apply an appropriate key-rotation and recovery policy.
-
Validate or clearly document the security requirements for a caller-supplied backup directory. Reject locations that are not directories, are owned by another user, or are writable by group or other users when such sharing is not explicitly intended.
A minimally hardened implementation should begin with:
bash umask 077 BACKUP_DIR="${1:-$HOME/openclaw-backups}" DATE="$(date +%Y-%m-%d_%H%M)" BACKUP_FILE="$BACKUP_DIR/openclaw-$DATE.tar.gz" install -d -m 700 -- "$BACKUP_DIR" chmod 700 -- "$BACKUP_DIR" tar -czf "$BACKUP_FILE" \ --exclude="completions" \ --exclude="*.log" \ -C "$HOME" .openclaw/ chmod 600 -- "$BACKUP_FILE"-