QuarkPan Backup Suite

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:20 AM UTC
• Version: 0.2.0

Overview

This backup skill has a coherent purpose, but it tells users to run high-impact backup, cloud-upload, restore, and snapshot commands implemented by scripts that are not included for review.

Review before installing. Only use this skill in an environment where you already trust and can inspect the referenced scripts/backup helpers, and do not run the upload, restore, cron, or snapshot commands until their paths, ownership, permissions, and behavior are verified. Treat Quark cookies, backup archives, restore indexes, and snapshot commands as sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/commands.md:6
• Finding: Security-Critical Operations Delegate to Unbundled and Unverified External Scripts## Vulnerability Details **File Location**: `references/commands.md:6-63`; related workflow declarations in `SKILL.md:26-28,37-42` **Vulnerability Type**: Execution of ambient, unverified operational scripts **Risk Level**: High ### Vulnerable Code ```bash scripts/backup/quarkpan-login.sh scripts/backup/quark-account-guard.sh bind --confirm YES_I_UNDERSTAND scripts/backup/quark-account-guard.sh status ``` ```bash scripts/backup/backup-cron.sh daily scripts/backup/backup-cron.sh weekly ``` ```bash scripts/backup/upload-cloud.sh /path/archive.tar.gz /path/archive.tar.gz.sha256 smoke-openlist ``` ```bash scripts/backup/restore-quarkpan.sh --from-index /root/.openclaw/backup/indexes/cloud-daily-YYYY-MM-DD.txt --dry-run ``` ```bash scripts/backup/lighthouse-snapshot-create.sh --wait ``` ```bash scripts/backup/lighthouse-snapshot-prune.sh --keep 2 scripts/backup/lighthouse-snapshot-prune.sh --keep 2 --apply ``` ```bash scripts/backup/lighthouse-snapshot-apply.sh --snapshot-id lhsnap-xxxx --confirm YES_I_UNDERSTAND ``` ```bash scripts/backup/system-state-backup.sh ``` ### Technical Analysis The Skill directs users or an Agent to execute numerous programs under `scripts/backup/`, but none of those programs are included in the audited project. The only packaged executable is `scripts/check_env.sh`. Because these commands use relative paths, their targets depend on the process working directory rather than a canonical path anchored to the installed Skill. The package also provides no integrity hash, signature, ownership check, or trusted installation procedure for the missing scripts. Consequently, the security controls described by the documentation—including account UID binding, token rotation, dry-run restoration, cloud-upload safeguards, and explicit snapshot confirmation—cannot be verified. Their enforcement is delegated entirely to external code that may differ from the documented behavior. ### Attack Path 1. An attacker gains write access to the wor ...[truncated 1572 chars]
• Remediation: ## Remediation Suggestions 1. Bundle every required operational script in the Skill so its implementation can be reviewed and distributed atomically. 2. Resolve executable paths relative to the verified Skill directory instead of the caller's working directory. 3. Refuse to proceed when any required component is absent. 4. Verify each helper's cryptographic digest or signed manifest before execution. 5. Validate that each executable is a regular file, is not a symbolic link, has trusted ownership, and is not writable by untrusted users. 6. Implement account binding, credential redaction, dry-run enforcement, and destructive-operation confirmation in the bundled and audited code. 7. Use absolute, canonical paths after validating them against an allowed installation root. 8. Apply least privilege: cloud-upload helpers should not receive snapshot or restore permissions, and destructive system operations should be isolated from ordinary backup operations. 9. Add automated integration tests proving that UID mismatch blocks uploads and that restore or snapshot operations cannot run without the required confirmation.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_env.sh:18
• Finding: Environment Preflight Reports Success When Critical Dependencies Are Missing## Vulnerability Details **File Location**: `scripts/check_env.sh:18-54` **Vulnerability Type**: Fail-open dependency and security-component validation **Risk Level**: Medium ### Vulnerable Code ```bash if python3 - <<'PY' >/dev/null 2>&1 import httpx PY then echo "[OK] python httpx" else echo "[ERR] missing python module: httpx" fi if [[ -x /root/.openclaw/workspace/scripts/backup/quark-openlist-upload.py ]]; then echo "[OK] quark-openlist-upload.py" else echo "[WARN] quark-openlist-upload.py not found at expected path" fi if [[ -x /root/.openclaw/workspace/scripts/backup/.venv-quark/bin/quarkpan ]]; then echo "[OK] quarkpan auth/guard helper" else echo "[WARN] quarkpan not found at expected path" fi if [[ -x /root/.openclaw/workspace/scripts/backup/.venv-tccli/bin/tccli ]]; then echo "[OK] tccli" else echo "[WARN] tccli not found at expected path" fi if [[ -f /root/.openclaw/workspace/scripts/backup/backup.conf ]]; then if grep -q '^CLOUD_SPLIT_FALLBACK=0' /root/.openclaw/workspace/scripts/backup/backup.conf; then echo "[OK] split fallback disabled" else echo "[WARN] CLOUD_SPLIT_FALLBACK is not 0" fi fi echo "[DONE] env check finished" ``` ### Technical Analysis Although the script enables `set -euo pipefail`, the critical checks are placed inside conditional statements whose failure is handled only by printing messages. Missing `httpx` produces an `[ERR]` message but does not return a failure status. Missing upload, authentication, account-guard, or snapshot tooling produces only `[WARN]` messages. The final command is an unconditional successful `echo`, so the script normally exits with status zero even when these dependencies are unavailable. It also succeeds when `backup.conf` is entirely absent because there is no corresponding `else` branch. This behavior creates a mismatch between human-readable diagnostics and machine-readable status. An orchestration process can interpret the environment as saf ...[truncated 1886 chars]
• Remediation: ## Remediation Suggestions 1. Maintain an explicit failure counter or terminate immediately when a mandatory dependency is missing. 2. Exit with a nonzero status if `httpx`, the uploader, the account-guard helper, required configuration, or any other mandatory component is unavailable. 3. Distinguish required dependencies from genuinely optional tools and document that distinction. 4. Validate that `backup.conf` exists; fail if it is absent or if required safety settings are missing. 5. Parse configuration structurally rather than relying only on a narrowly formatted `grep` expression. 6. Resolve canonical paths and verify that helpers are regular files rather than symbolic links. 7. Check trusted ownership and reject files writable by group members or other users. 8. Validate helper integrity against a signed manifest or pinned cryptographic hashes. 9. End the script with an explicit status, for example: ```bash failures=0 require_file() { local path="$1" if [[ ! -f "$path" || ! -x "$path" ]]; then echo "[ERR] required executable missing: $path" >&2 failures=$((failures + 1)) fi } # Perform all required checks here. if (( failures > 0 )); then echo "[FAILED] environment is not ready" >&2 exit 1 fi echo "[DONE] environment check passed" exit 0 ``` 10. Add automated tests asserting a nonzero exit status for every missing mandatory component and unsafe configuration state.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly describes network-capable behavior such as QR login, cloud uploads, account checks, and sharing/package distribution, but it does not declare any explicit tool scope or allowed tools. That mismatch weakens policy enforcement and reviewability: an agent may be permitted to perform sensitive network actions without a narrowly declared capability boundary, increasing the risk of unintended data exfiltration or misuse of authenticated sessions.

Static analysis

No suspicious patterns detected.