Security audit

OpenClaw Checkpoint - Personal AI Assistant Backup & Recovery (Github)

Security checks for vulnerabilities and agentic risk

Overview

The skill’s backup purpose is coherent, but its install and recovery docs repeatedly tell users to run an unverified remote installer directly in a shell.

Review this skill carefully before installing. Prefer the clone-and-inspect path, avoid the curl-to-bash commands, verify the remote repository and scripts yourself, and only use a private GitHub repo because backups can include identity, memory, agent files, scripts, configuration, and scheduled-task definitions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: INSTALL.md:22
Finding: Mutable Remote Installer Is Downloaded and Executed Without Integrity Verification
Content: View full analysis
Vulnerability Details

File Locations:

INSTALL.md:22

README.md:51

README.md:89

SKILL.md:48

SKILL.md:342

SKILL.md:508

Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Complete Vulnerable Code Snippet:

bash
curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash

Technical Analysis

The installation and recovery documentation repeatedly instructs users to download a shell script from the mutable main branch of a personal GitHub repository and stream it directly into Bash.

The command provides no immutable commit or release pin, cryptographic signature, checksum validation, or local review step. Consequently, the code executed by a user can differ from the code that existed when this Skill was audited. The referenced installer and installed checkpoint scripts are not included in the audited artifact, which contains only Markdown files, so their behavior cannot be statically verified.

Piping the response directly into Bash also eliminates a meaningful inspection boundary. TLS protects the network connection but does not establish that the repository owner, account, or current branch content is trustworthy. Compromise of the GitHub account or intentional modification of the remote script would allow the payload to be changed without modifying this Skill package.

The behavior exceeds the minimum privileges needed to present installation instructions because a safer clone-and-review procedure is already documented. Direct execution of an unverified mutable payload is not necessary for the declared backup and restore functionality.

Attack Path

An attacker compromises the referenced GitHub account or otherwise gains the ability to modify the installer on the repository's main branch.

The attacker replaces the installer with commands that ste ...[truncated 1570 chars]
Remediation: View remediation
Remediation Suggestions

Remove every curl | bash installation command from INSTALL.md, README.md, and SKILL.md.

Include the installer and all executable checkpoint scripts in the audited Skill package so reviewers can verify the exact code users will execute.

Prefer installation from a reviewed repository checkout pinned to an immutable commit or signed release tag.

If remote download remains necessary:

Download the installer to a local file rather than piping it into a shell.

Pin the URL to an immutable commit or versioned release.

Publish and verify a SHA-256 checksum or cryptographic signature.

Require users to inspect the downloaded file before execution.

Abort installation if verification fails.

Use a command sequence such as:

bash
curl -fL -o install-openclaw-checkpoint.sh \ https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/IMMUTABLE_COMMIT/scripts/install-openclaw-checkpoint.sh echo "EXPECTED_SHA256 install-openclaw-checkpoint.sh" | shasum -a 256 -c - less install-openclaw-checkpoint.sh bash install-openclaw-checkpoint.sh

Sign release artifacts and document how users can verify the signing identity.

Avoid silently changing installation behavior through a mutable default branch.

Clearly document every file, SSH configuration item, scheduled task, and shell profile entry modified by the installer.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (39)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The use of a shell pipe into bash is a classic unsafe chaining pattern because it converts a network response directly into executable shell code with no review barrier. In this skill's context, that code can install commands, modify PATH-related setup, and potentially alter backup or restore behavior, increasing the blast radius of any upstream compromise.
Content: Scanner excerpt · INSTALL.md (reported line 22)May include surrounding context.
Quick Install

bash
curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash

This runs the install script -- review it first if you prefer to inspect before executing.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The '| bash' construct creates direct command chaining from a remote source into a shell, collapsing fetch and execution into one step with no validation boundary. This is dangerous because any compromise of the source or transport can instantly become arbitrary code execution under the user's account.
Content: Scanner excerpt · README.md (reported line 51)May include surrounding context.
Quick Install

bash
curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash

This runs the install script -- review it first if you prefer to inspect before executing.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Using '| bash' in the restore workflow is especially risky because it is likely to be executed on a new or rebuilt machine with elevated trust in recovery steps. It enables arbitrary code execution from a remote mutable source without any review or integrity check.
Content: Scanner excerpt · README.md (reported line 89)May include surrounding context.
md
# On new machine: # 1. Install checkpoint skill and restore interactively curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash checkpoint-restore # 2. Restore API keys from your password manager

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The command chains a network fetch directly into a shell interpreter, which removes the user's opportunity to inspect the script and turns any upstream compromise into immediate code execution. This is especially risky in skill installation docs because users may treat the command as trusted setup boilerplate.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
Option 2: Quick Install

bash
curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash

This runs the install script -- review it first if you prefer to inspect before executing.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 124)May include surrounding context.
md
**What it does:** - Guides you through creating a PRIVATE GitHub repository - Sets up SSH authentication (recommended) or Personal Access Token - Automatically detects if SSH key is already authorized on GitHub - Detects agents in `~/.openclaw/agents/` and reports they will be included in backups - Generates a README.md with recovery instructions and commands

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
**What it does:** - Guides you through creating a PRIVATE GitHub repository - Sets up SSH authentication (recommended) or Personal Access Token - Automatically detects if SSH key is already authorized on GitHub - Detects agents in `~/.openclaw/agents/` and reports they will be included in backups - Generates a README.md with recovery instructions and commands

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
**What it does:** - Guides you through creating a PRIVATE GitHub repository - Sets up SSH authentication (recommended) or Personal Access Token - Automatically detects if SSH key is already authorized on GitHub - Detects agents in `~/.openclaw/agents/` and reports they will be included in backups - Generates a README.md with recovery instructions and commands

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This chained execution pattern appears again during restore onboarding, where users may prioritize speed over scrutiny. That context increases the likelihood of exploitation if the remote source is tampered with.
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
bash
# Install the checkpoint skill first curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash # Run checkpoint-restore - it will guide you through the entire process checkpoint-restore

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Using curl | bash in the disaster recovery path compounds risk because users may execute it under stress on a fresh machine that will soon contain sensitive state. A compromised installer could immediately seize the environment before or during restore.
Content: Scanner excerpt · SKILL.md (reported line 508)May include surrounding context.
md
brew install openclaw # or your install method # 2. Install checkpoint skill and run interactive restore curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash checkpoint-restore # Follow the interactive prompts to: # - Authenticate with GitHub

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 608)May include surrounding context.
"Host key verification failed"

GitHub's SSH host key isn't in your known_hosts. Fix with:

bash
ssh-keyscan -t ed25519 github.com >> ~/.ssh/known_hosts

"Permission denied (publickey)"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 629)May include surrounding context.
Agent has nested .git errors

The backup process automatically strips .git directories from agent copies. If you see submodule warnings, run a fresh backup:

bash
rm -rf ~/.openclaw/workspace/agents checkpoint-backup

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 629)May include surrounding context.
Agent has nested .git errors

The backup process automatically strips .git directories from agent copies. If you see submodule warnings, run a fresh backup:

bash
rm -rf ~/.openclaw/workspace/agents checkpoint-backup

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · INSTALL.md (reported line 8)May include surrounding context.
bash
git clone https://github.com/AnthonyFrancis/openclaw-checkpoint.git ~/.openclaw/skills/openclaw-checkpoint mkdir -p ~/.openclaw/workspace/tools cp ~/.openclaw/skills/openclaw-checkpoint/scripts/checkpoint* ~/.openclaw/workspace/tools/ chmod +x ~/.openclaw/workspace/tools/checkpoint*

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-install command downloads a remote script and immediately executes it with bash, giving that remote content full code-execution rights on the user's machine. Although framed as a convenience installer, this is dangerous because compromise of the GitHub account, repository, branch, or transport path would turn installation into arbitrary command execution beyond the documented backup/restore scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The install instructions recommend piping a remote script directly to bash, and the surrounding text does not provide a strong enough warning for the level of risk involved. Users may execute unreviewed code under their own account, which is especially risky for a tool that installs executables into the user's PATH and persists behavior across sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The restore workflow explicitly states it restores OpenClaw state and may restore cron jobs, but it does not clearly warn that local files, agent state, configuration, or scheduled tasks may be overwritten or replaced. In the context of a backup/restore skill, omission of that warning increases the chance of destructive user actions and unintended persistence through restored scheduled tasks.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 31)May include surrounding context.
md
git clone https://github.com/AnthonyFrancis/openclaw-checkpoint.git ~/.openclaw/skills/openclaw-checkpoint # Copy scripts to your tools directory mkdir -p ~/.openclaw/workspace/tools cp ~/.openclaw/skills/openclaw-checkpoint/scripts/checkpoint* ~/.openclaw/workspace/tools/ chmod +x ~/.openclaw/workspace/tools/checkpoint*

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 35)May include surrounding context.
md
cp ~/.openclaw/skills/openclaw-checkpoint/scripts/checkpoint* ~/.openclaw/workspace/tools/ chmod +x ~/.openclaw/workspace/tools/checkpoint* # Add to PATH (add to ~/.zshrc or ~/.bashrc for persistence) export PATH="${HOME}/.openclaw/workspace/tools:${PATH}" # Run setup

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
cp ~/.openclaw/skills/openclaw-checkpoint/scripts/checkpoint* ~/.openclaw/workspace/tools/ chmod +x ~/.openclaw/workspace/tools/checkpoint* # Add to PATH (add to ~/.zshrc or ~/.bashrc for persistence) export PATH="${HOME}/.openclaw/workspace/tools:${PATH}" # Run setup

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Piping a remotely fetched script directly into bash executes unpinned, unaudited code immediately, creating a supply-chain and remote-code-execution risk. The brief note to review it first is weak because the command as written bypasses review and trains unsafe installation behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 136)May include surrounding context.
Restore happens automatically during checkpoint-restore -- it detects the backup file and offers to restore your cron jobs. If you prefer to restore manually:

bash
# Manually inspect and recreate jobs: cat ~/.openclaw/workspace/memory/cron-jobs-backup.json

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 156)May include surrounding context.
md
This skill uses standard system scheduling to automate backups: - **macOS**: Creates a launchd plist at `~/Library/LaunchAgents/com.openclaw.checkpoint.plist` - **Linux**: Adds a user-level cron job (visible via `crontab -l`) Auto-backup is **opt-in only** -- it is never enabled unless you explicitly run `checkpoint-schedule`. You can disable it at any time with `checkpoint-stop` or `checkpoint-schedule disable`.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
This skill uses standard system scheduling to automate backups: - **macOS**: Creates a launchd plist at `~/Library/LaunchAgents/com.openclaw.checkpoint.plist` - **Linux**: Adds a user-level cron job (visible via `crontab -l`) Auto-backup is **opt-in only** -- it is never enabled unless you explicitly run `checkpoint-schedule`. You can disable it at any time with `checkpoint-stop` or `checkpoint-schedule disable`.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.
md
This skill uses standard system scheduling to automate backups: - **macOS**: Creates a launchd plist at `~/Library/LaunchAgents/com.openclaw.checkpoint.plist` - **Linux**: Adds a user-level cron job (visible via `crontab -l`) Auto-backup is **opt-in only** -- it is never enabled unless you explicitly run `checkpoint-schedule`. You can disable it at any time with `checkpoint-stop` or `checkpoint-schedule disable`.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 157)May include surrounding context.
md
This skill uses standard system scheduling to automate backups: - **macOS**: Creates a launchd plist at `~/Library/LaunchAgents/com.openclaw.checkpoint.plist` - **Linux**: Adds a user-level cron job (visible via `crontab -l`) Auto-backup is **opt-in only** -- it is never enabled unless you explicitly run `checkpoint-schedule`. You can disable it at any time with `checkpoint-stop` or `checkpoint-schedule disable`.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:629

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Chaining Abuse

Quick Install

Chaining Abuse

Quick Install

Chaining Abuse

Chaining Abuse

Option 2: Quick Install

Credential Access

Credential Access

Credential Access

Chaining Abuse

Chaining Abuse

Credential Access

"Host key verification failed"

"Permission denied (publickey)"

Tool Parameter Abuse

Agent has nested .git errors

Tool Parameter Abuse

Agent has nested .git errors

Session Persistence

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Session Persistence

Session Persistence

Session Persistence

Missing User Warnings

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.