ClawHub
Back to skill

Security audit

OpenClaw Backup

Security checks across malware telemetry and agentic risk

Overview

This skill performs a local OpenClaw backup and restore as advertised, but users should handle the archives and restore commands carefully because they contain secrets and can replace current state.

Install only if you want full local backups of OpenClaw. Treat every generated archive like a password vault: keep it private, restrict permissions, prefer encrypted storage, avoid syncing or sharing it with untrusted services, verify the cron script path before enabling scheduled backups, and review restore or rollback commands carefully before replacing or deleting ~/.openclaw.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The skill tells users to run './scripts/backup.sh [backup_dir]' but the cron payload later instructs 'Run ~/.openclaw/backup.sh', which is a contradictory path. This inconsistency can cause failed backups or execution of an unintended file at the alternate path, which is risky in a privileged or automated scheduled context.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The backup scope explicitly includes 'credentials/', 'agents/' auth profiles, and 'telegram/' session data, but the skill does not prominently warn that the archive will contain highly sensitive secrets. Users may store or transmit backups insecurely, turning a routine backup into a credential and session-token exposure vector.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The restore sequence renames the existing '~/.openclaw' directory before extraction without an explicit warning about overwriting state, downtime, rollback expectations, or integrity verification of the backup archive. In practice this can lead to accidental data loss, restoration of stale or tampered state, and disruption of live credentials or sessions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The rollback section instructs the user to run `rm -rf ~/.openclaw` with no confirmation prompt, no warning about irreversible deletion, and no validation that `~/.openclaw-old` exists and is intact before removing the current directory. In a backup/restore skill, this is especially dangerous because the directory contains credentials, agent configs, workspace data, and scheduled tasks, so a failed or mistyped rollback can cause permanent loss of sensitive and operational data.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
---

# OpenClaw Backup
Confidence
84% confidence
Finding
create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions. --- # OpenClaw Backup Backup and re

Tool Parameter Abuse

High
Category
Tool Misuse
Content
SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)
Confidence
89% confidence
Finding
rm COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/

Chaining Abuse

High
Category
Tool Misuse
Content
SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)
Confidence
84% confidence
Finding
| xargs -r rm

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.