Security audit

OpenClaw Checkpoint - Personal AI Assistant Backup & Recovery (Github)

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate backup-and-restore skill, but it needs review because it recommends running unverified remote shell code and its documentation does not consistently describe the files and schedulers it can touch.

Install only after reviewing the GitHub repository and scripts, preferably using the git-clone path instead of curl-to-bash. Use a private repository, narrowly scoped GitHub authentication, and confirm exactly which workspace, agent, shell profile, cron, and launchd paths will be changed before enabling automatic backups or running restore/reset commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The README asserts the skill only reads and writes within ~/.openclaw/workspace, but the same document describes modifying ~/.openclaw/skills, ~/.openclaw/agents, shell rc files, user cron, and ~/Library/LaunchAgents. This kind of scope minimization is dangerous because it can cause users to grant trust under false assumptions about what the skill changes on their system.

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: The README says the skill does not install background daemons or system services, yet it explicitly documents creation of a launchd agent and cron-based scheduled execution. Even if these run in user context, they are still persistence mechanisms, and understating that behavior can mislead users about ongoing automated execution.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The installation instructions tell users to execute a remote script directly via `curl ... | bash`, which is a well-known unsafe pattern because it runs downloaded code without a review step, integrity verification, or pinning to a specific trusted artifact. In this skill's context, the installer would run with the user's privileges and is designed to modify OpenClaw tooling and backup configuration, so a compromised repository, MITM in a weakened trust environment, or malicious update could lead to arbitrary code execution and persistence.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The restore workflow is described without a prominent warning that restoring a checkpoint may overwrite current workspace state, scripts, memories, or configuration. Users may unintentionally destroy local data or reintroduce stale or unsafe state from backup if the overwrite semantics are not explicit.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The README says it automatically syncs identity, memory, and configuration to GitHub, but the privacy implications of uploading highly personal workspace content are not made prominent at the point of first introduction. In this context, the backed-up data may include sensitive notes, conversation history, behavior definitions, and operational details, so insufficient early warning increases accidental disclosure risk.

External Script Fetching

Low

Category: Supply Chain
Content: # On new machine: # 1. Install checkpoint skill and restore interactively curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash checkpoint-restore # 2. Restore API keys from your password manager
Confidence: 97% confidence
Finding: curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash

External Script Fetching

Low

Category: Supply Chain
Content: brew install openclaw # or your install method # 2. Install checkpoint skill and run interactive restore curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash checkpoint-restore # Follow the interactive prompts to: # - Authenticate with GitHub
Confidence: 98% confidence
Finding: curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash

Chaining Abuse

High

Category: Tool Misuse
Content: # On new machine: # 1. Install checkpoint skill and restore interactively curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash checkpoint-restore # 2. Restore API keys from your password manager
Confidence: 98% confidence
Finding: | bash

Chaining Abuse

High

Category: Tool Misuse
Content: brew install openclaw # or your install method # 2. Install checkpoint skill and run interactive restore curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bash checkpoint-restore # Follow the interactive prompts to: # - Authenticate with GitHub
Confidence: 98% confidence
Finding: | bash

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:629