OpenClaw Backup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

This backup skill is purpose-aligned, but it handles credentials and session data in plaintext backups and includes unsafe restore/delete guidance without enough safeguards.

Review before installing. Only use this with trusted local backup locations, protect archives like live credentials, consider encrypting them, and avoid following the restore or rollback commands until you have verified the backup contents and made a separate safety copy of current ~/.openclaw.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.sh:5

Finding

Sensitive credential backups are created without enforced access restrictions

Content

View full analysis

/dev/null ``` The documented backup contents confirm that the archive includes high-value secrets: ```markdown - `credentials/` — API keys, tokens - `agents/` — agent configs, auth profiles - `workspace/` — memory, SOUL.md, user files - `telegram/` — session data - `cron/` — scheduled tasks ``` ### Technical Analysis The script archives the complete `~/.openclaw` directory, including credentials, authentication profiles, session data, private workspace content, and scheduled-task definitions. The resulting archive is not encrypted. More importantly, the script does not establish a restrictive `umask`, assign mode `0700` to the backup directory, or assign mode `0600` to the resulting archive. Consequently, permissions depend on the invoking process's umask and any existing permissions on the user-supplied backup directory. With a common permissive umask such as `022`, the archive may be created as readable by other local users. The optional destination argument also permits backups to be written into an existing shared or otherwise insufficiently protected directory without validation or warning. ### Attack Path 1. A victim invokes `scripts/backup.sh`, optionally specifying a shared or permissively accessible backup directory. 2. The script creates a compressed archive containing API keys, tokens, authentication profiles, Telegram session data, private workspace files, and cron definitions. 3. Because no restrictive permissions are ...[truncated 1062 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/backup.sh:19

Finding

Backup rotation parses filenames unsafely through ls and xargs

Content

View full analysis

/dev/null | tail -n +8 | xargs -r rm ``` ### Technical Analysis The rotation logic treats the textual output of `ls` as a machine-readable list and passes it to `xargs`. Unix filenames may contain spaces, tabs, quotes, backslashes, and newline characters. `xargs` performs its own tokenization and quoting interpretation rather than preserving each line as one exact pathname. As a result, a matching filename may be divided into multiple arguments, interpreted incorrectly, or cause `xargs` to terminate with a parsing error. This can prevent intended backups from being removed or cause `rm` to receive path arguments different from the path emitted by `ls`. The issue is exploitable only when an attacker or another untrusted process can create crafted `openclaw-*.tar.gz` entries in the selected backup directory. That condition is more likely when a custom shared directory is supplied. ### Attack Path 1. The victim selects a backup directory writable by another local principal, or the directory otherwise has unsafe permissions. 2. The attacker creates one or more files matching `openclaw-*.tar.gz` whose names contain whitespace, newline characters, quotes, or backslashes. 3. The victim runs the backup script after enough matching entries exist to trigger rotation. 4. `ls` emits the crafted names as text, and `xargs` tokenizes that text into arguments that do not preserve the original filenames. 5. Rotation fails, removes incorrectly parsed paths where such paths resolve, or retains backups that should have been deleted. ### Impact Assessment The primary impact is availability and retention-policy failure: - Backup rotation can be interrupted. - Old sensitive backups may remain beyond th ...[truncated 374 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code aligns with part of the description: it archives ~/.openclaw with exclusions and performs backup rotation. However, the declared purpose materially overstates the implemented functionality by claiming restore support and automatic backup scheduling, neither of which appears in the supplied script. There are no obvious undeclared harmful capabilities; the mismatch is that the description is broader than the actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The rollback instructions include irreversible deletion of ~/.openclaw using rm -rf without any warning, confirmation step, or validation that the path is correct. Because this is operational guidance in a restore document, users may copy-paste it during incident recovery when they are stressed, increasing the chance of permanent data loss if the command is misapplied.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The documented command rm -rf ~/.openclaw performs unconditional recursive deletion of the application's state directory, which may contain credentials, workspace data, scheduled tasks, and other irreplaceable information if the backup is stale or missing. In the context of a backup/restore skill, this is especially dangerous because the command is presented as a routine recovery step and may be executed without validation or safeguards.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The documented command rm -rf ~/.openclaw performs unconditional recursive deletion of the application's state directory, which may contain credentials, workspace data, scheduled tasks, and other irreplaceable information if the backup is stale or missing. In the context of a backup/restore skill, this is especially dangerous because the command is presented as a routine recovery step and may be executed without validation or safeguards.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

The pipeline ls -t ... | tail -n +8 | xargs -r rm performs deletion based on parsing command output and passes results to rm without using null-delimited handling or -- end-of-options protection. If an attacker can place crafted filenames in the backup directory, especially names containing whitespace, newlines, or option-like prefixes, the rotation step may delete unintended files or interpret filenames as rm options.

Content

Scanner excerpt · scripts/backup.sh (reported line 21)May include surrounding context.

sh

SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill’s stated purpose includes backing up and restoring persistent state from ~/.openclaw, including credentials, workspace memory, Telegram session data, and cron tasks. In context, this is legitimate functionality, but it still increases security exposure because it preserves and propagates authentication material and session state, potentially extending compromise impact if backups are stolen or restored from tampered archives.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
---

# OpenClaw Backup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The backup instructions explicitly include credentials, tokens, auth profiles, workspace data, and session data, but they do not warn that the resulting archive is highly sensitive. This can lead users to store, copy, or transmit backups insecurely, effectively concentrating secrets into a single portable file that could enable account takeover or disclosure of private data if accessed by others.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The restore workflow includes replacing the live ~/.openclaw directory via a move and extraction sequence without clearly warning that this overwrites the active state and may restore stale or malicious configuration, credentials, scheduled tasks, or session data. A user following these steps could unintentionally destroy current data integrity or reintroduce compromised artifacts from an untrusted backup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The restore workflow replaces an existing ~/.openclaw directory by moving it aside and then extracting backup contents over the home directory without any explicit warning about overwrite, path expectations, or validation of the archive. In a backup/restore skill, users are likely to run these commands directly, so missing safety guidance can lead to accidental data loss or restoration of unexpected files from a malformed or untrusted archive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This shell script performs a destructive operation by removing older backup archives during rotation. Although the script prints success messages after completion, it does not disclose beforehand that running the backup will automatically delete existing backups beyond the most recent seven.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.