QuarkPan Backup Suite

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:20 AM UTC
• Version: 0.2.0

Overview

This backup skill has a coherent purpose, but it tells users to run high-impact backup, cloud-upload, restore, and snapshot commands implemented by scripts that are not included for review.

Review before installing. Only use this skill in an environment where you already trust and can inspect the referenced scripts/backup helpers, and do not run the upload, restore, cron, or snapshot commands until their paths, ownership, permissions, and behavior are verified. Treat Quark cookies, backup archives, restore indexes, and snapshot commands as sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/commands.md:6

Finding

Security-Critical Operations Delegate to Unbundled and Unverified External Scripts

Content

View full analysis

Vulnerability Details

File Location: references/commands.md:6-63; related workflow declarations in SKILL.md:26-28,37-42
Vulnerability Type: Execution of ambient, unverified operational scripts
Risk Level: High

Vulnerable Code

bash

scripts/backup/quarkpan-login.sh
scripts/backup/quark-account-guard.sh bind --confirm YES_I_UNDERSTAND
scripts/backup/quark-account-guard.sh status

bash

scripts/backup/backup-cron.sh daily
scripts/backup/backup-cron.sh weekly

bash

scripts/backup/upload-cloud.sh /path/archive.tar.gz /path/archive.tar.gz.sha256 smoke-openlist

bash

scripts/backup/restore-quarkpan.sh --from-index /root/.openclaw/backup/indexes/cloud-daily-YYYY-MM-DD.txt --dry-run

bash

scripts/backup/lighthouse-snapshot-create.sh --wait

bash

scripts/backup/lighthouse-snapshot-prune.sh --keep 2
scripts/backup/lighthouse-snapshot-prune.sh --keep 2 --apply

bash

scripts/backup/lighthouse-snapshot-apply.sh --snapshot-id lhsnap-xxxx --confirm YES_I_UNDERSTAND

bash

scripts/backup/system-state-backup.sh

Technical Analysis

The Skill directs users or an Agent to execute numerous programs under scripts/backup/, but none of those programs are included in the audited project. The only packaged executable is scripts/check_env.sh.

Because these commands use relative paths, their targets depend on the process working directory rather than a canonical path anchored to the installed Skill. The package also provides no integrity hash, signature, ownership check, or trusted installation procedure for the missing scripts.

Consequently, the security controls described by the documentation—including account UID binding, token rotation, dry-run restoration, cloud-upload safeguards, and explicit snapshot confirmation—cannot be verified. Their enforcement is delegated entirely to external code that may differ from the documented behavior.

Attack Path

1. An attacker gains write access to the wor ...[truncated 1572 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle every required operational script in the Skill so its implementation can be reviewed and distributed atomically.
2. Resolve executable paths relative to the verified Skill directory instead of the caller's working directory.
3. Refuse to proceed when any required component is absent.
4. Verify each helper's cryptographic digest or signed manifest before execution.
5. Validate that each executable is a regular file, is not a symbolic link, has trusted ownership, and is not writable by untrusted users.
6. Implement account binding, credential redaction, dry-run enforcement, and destructive-operation confirmation in the bundled and audited code.
7. Use absolute, canonical paths after validating them against an allowed installation root.
8. Apply least privilege: cloud-upload helpers should not receive snapshot or restore permissions, and destructive system operations should be isolated from ordinary backup operations.
9. Add automated integration tests proving that UID mismatch blocks uploads and that restore or snapshot operations cannot run without the required confirmation.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_env.sh:18

Finding

Environment Preflight Reports Success When Critical Dependencies Are Missing

Content

View full analysis

Vulnerability Details

File Location: scripts/check_env.sh:18-54
Vulnerability Type: Fail-open dependency and security-component validation
Risk Level: Medium

Vulnerable Code

bash

if python3 - <<'PY' >/dev/null 2>&1
import httpx
PY
then
  echo "[OK] python httpx"
else
  echo "[ERR] missing python module: httpx"
fi

if [[ -x /root/.openclaw/workspace/scripts/backup/quark-openlist-upload.py ]]; then
  echo "[OK] quark-openlist-upload.py"
else
  echo "[WARN] quark-openlist-upload.py not found at expected path"
fi

if [[ -x /root/.openclaw/workspace/scripts/backup/.venv-quark/bin/quarkpan ]]; then
  echo "[OK] quarkpan auth/guard helper"
else
  echo "[WARN] quarkpan not found at expected path"
fi

if [[ -x /root/.openclaw/workspace/scripts/backup/.venv-tccli/bin/tccli ]]; then
  echo "[OK] tccli"
else
  echo "[WARN] tccli not found at expected path"
fi

if [[ -f /root/.openclaw/workspace/scripts/backup/backup.conf ]]; then
  if grep -q '^CLOUD_SPLIT_FALLBACK=0' /root/.openclaw/workspace/scripts/backup/backup.conf; then
    echo "[OK] split fallback disabled"
  else
    echo "[WARN] CLOUD_SPLIT_FALLBACK is not 0"
  fi
fi

echo "[DONE] env check finished"

Technical Analysis

Although the script enables set -euo pipefail, the critical checks are placed inside conditional statements whose failure is handled only by printing messages. Missing httpx produces an [ERR] message but does not return a failure status. Missing upload, authentication, account-guard, or snapshot tooling produces only [WARN] messages.

The final command is an unconditional successful echo, so the script normally exits with status zero even when these dependencies are unavailable. It also succeeds when backup.conf is entirely absent because there is no corresponding else branch.

This behavior creates a mismatch between human-readable diagnostics and machine-readable status. An orchestration process can interpret the environment as saf ...[truncated 1886 chars]

Remediation

View remediation

Remediation Suggestions

1. Maintain an explicit failure counter or terminate immediately when a mandatory dependency is missing.
2. Exit with a nonzero status if httpx, the uploader, the account-guard helper, required configuration, or any other mandatory component is unavailable.
3. Distinguish required dependencies from genuinely optional tools and document that distinction.
4. Validate that backup.conf exists; fail if it is absent or if required safety settings are missing.
5. Parse configuration structurally rather than relying only on a narrowly formatted grep expression.
6. Resolve canonical paths and verify that helpers are regular files rather than symbolic links.
7. Check trusted ownership and reject files writable by group members or other users.
8. Validate helper integrity against a signed manifest or pinned cryptographic hashes.
9. End the script with an explicit status, for example:

bash

failures=0

require_file() {
  local path="$1"
  if [[ ! -f "$path" || ! -x "$path" ]]; then
    echo "[ERR] required executable missing: $path" >&2
    failures=$((failures + 1))
  fi
}

# Perform all required checks here.

if (( failures > 0 )); then
  echo "[FAILED] environment is not ready" >&2
  exit 1
fi

echo "[DONE] environment check passed"
exit 0

10. Add automated tests asserting a nonzero exit status for every missing mandatory component and unsafe configuration state.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly describes network-capable behavior such as QR login, cloud uploads, account checks, and sharing/package distribution, but it does not declare any explicit tool scope or allowed tools. That mismatch weakens policy enforcement and reviewability: an agent may be permitted to perform sensitive network actions without a narrowly declared capability boundary, increasing the risk of unintended data exfiltration or misuse of authenticated sessions.

Content

No source excerpt is available for this finding.