ClawHub
Back to skill

Security audit

Backup OpenClaw Config

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate backup-and-restore purpose, but it handles sensitive OpenClaw state with under-disclosed storage and restore risks that should be reviewed before installation.

Install only if you are comfortable with a skill that copies sensitive OpenClaw data, including credentials, memory, skills, and agent instructions, into local tar.gz archives. Prefer supplying a private backup directory yourself, encrypting archives, avoiding untrusted restore archives, and reviewing or disabling the automatic old-backup deletion before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/backup_openclaw.sh:6
Finding

Plaintext Sensitive Backups Are Written to an Unexpected Default Location

Content
View full analysis
/dev/null || { echo "[✗] Failed to create archive" exit 1 } ``` The backup scope includes sensitive OpenClaw data documented in `SKILL.md:163-166` and `references/config-locations.md:14, 27-32`, including credentials, tokens, memory, user context, agent instructions, custom skills, and extensions. ### Technical Analysis The shell script stores the complete backup as an unencrypted gzip-compressed tar archive. Compression provides no confidentiality. The script also does not set a restrictive process umask or explicitly assign secure permissions to the backup directory, archive, and metadata file. Their permissions therefore depend on the caller's environment and the existing permissions of `/data00`. The shell implementation's default directory, `/data00/backups/openclaw`, also conflicts with `SKILL.md`, which states that the default is `$HOME/backups/openclaw`. A shared or centrally mounted `/data00` directory may have a broader access boundary than a user's home directory. The adjacent `.info` file additionally discloses the hostname, username, backup time, archive size, and source paths. ### Attack Path 1. A user invokes `backup_openclaw.sh` without supplying an output directory, following the documented quick-start workflow. 2. The script selects `/data00/backups/openclaw` rather than the documented user-specific location. 3. The script collects OpenClaw configuration, tokens, memory, agent state, extensions, and ...[truncated 1012 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/restore_openclaw.sh:20
Finding

Restore Process Trusts Unauthenticated Archives Containing Executable Agent State

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/backup_openclaw.py:54
Finding

Python Backup Corrupts Directory Layout and Fails During Archive Name Construction

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The documentation claims backup-and-restore functionality while also stating that old backups are automatically deleted after 15 days. Automatic deletion is a destructive behavior not clearly aligned with a simple backup promise and may remove recovery points without explicit user approval, undermining reliability and causing data loss.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documentation claims backup-and-restore functionality while also stating that old backups are automatically deleted after 15 days. Automatic deletion is a destructive behavior not clearly aligned with a simple backup promise and may remove recovery points without explicit user approval, undermining reliability and causing data loss.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell commands and operational behavior that can create archives, modify files, and restore over user configuration, but it declares no explicit tool scope or permissions. In an agent setting, missing tool constraints increases the chance that the skill will be invoked with broader-than-necessary shell/file-write access, enabling unintended or unsafe filesystem changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

Automatically deleting backups older than 15 days is an autonomous destructive action that can remove recovery data without case-by-case user consent. Because the archives contain critical configuration and potentially irreplaceable workspace state, mistaken retention logic or unexpected scheduling can directly cause loss of the ability to recover.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
- Creates `openclaw_backup_YYYYMMDD_HHMMSS.tar.gz` archive
- Creates `openclaw_backup_YYYYMMDD_HHMMSS.info` metadata file
- Shows backup summary with file list and archive size
- **Automatically deletes backups older than 15 days** to manage disk space

### Restore from Backup

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- Verify backup directory exists or can be created
   - Check if OpenClaw directories exist

2. **Create backup structure**
   - Generate timestamp for unique backup name
   - Create temporary directory for staging

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

chmod +x ~/.openclaw/workspace/skills/backup-openclaw-config/scripts/*.sh

Ensure backup directory is writable

mkdir -p ~/backups/openclaw chmod 755 ~/backups/openclaw

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

Ensure backup directory is writable

mkdir -p ~/backups/openclaw chmod 755 ~/backups/openclaw

text

### Gateway Won't Start After Restore

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/backup_openclaw.py (reported line 45)May include surrounding context.

python
# Calculate size
                try:
                    size_result = subprocess.run(
                        ['du', '-sh', str(source_path)],
                        capture_output=True, text=True
                    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/backup_openclaw.py (reported line 78)May include surrounding context.

python
tar.add(file, arcname)
        
        # Calculate size
        size_result = subprocess.run(
            ['du', '-h', archive_file],
            capture_output=True, text=True
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script deletes backup archives older than 15 days even though its stated purpose is backup and restore. This expands the skill's behavior into destructive file operations without explicit user consent, which can cause irreversible loss of recovery points if the retention policy does not match the user's expectations or operational needs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Old backups are removed automatically with no upfront warning, interactive confirmation, or opt-in configuration. In a backup utility, silent deletion undermines the safety expectations of users and can lead to unexpected destruction of historical backups that may be needed for rollback, incident response, or delayed recovery.

Content

No source excerpt is available for this finding.