ClawHub
Back to skill

Security audit

Claw Sync

Security checks for vulnerabilities and agentic risk

Overview

This sync skill is broadly consistent with backup and restore, but it handles sensitive agent memory, skills, and Git credentials with enough unsafe and under-disclosed behavior that users should review it before installing.

Only install this after reviewing exactly what is in your OpenClaw workspace and skill directories, using a private repository and least-privilege token, and accepting that restore can replace agent behavior and skills. Avoid using --force unless you have a separate trusted backup, and do not rely on the current implementation to keep nested skill secrets out of Git history.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/push.js:239
Finding

Shell Command Injection Through Repository URL or Access Token

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/push.js:201
Finding

Recursive Skill Backup Can Upload Undisclosed Secrets

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/push.js:239
Finding

Repository Access Token Exposed in Child Process Arguments

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/pull.js:318
Finding

Unverified Remote Restore Can Poison Agent State and Replace Executable Skills

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (50)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Automatic scheduled task creation and persistent cron configuration would introduce stealthy persistence not disclosed by the manifest. Undeclared periodic triggers are especially risky in a sync skill because they can repeatedly exfiltrate updated memory or state without ongoing user interaction.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Automatic scheduled task creation and persistent cron configuration would introduce stealthy persistence not disclosed by the manifest. Undeclared periodic triggers are especially risky in a sync skill because they can repeatedly exfiltrate updated memory or state without ongoing user interaction.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Automatic scheduled task creation and persistent cron configuration would introduce stealthy persistence not disclosed by the manifest. Undeclared periodic triggers are especially risky in a sync skill because they can repeatedly exfiltrate updated memory or state without ongoing user interaction.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Automatic scheduled task creation and persistent cron configuration would introduce stealthy persistence not disclosed by the manifest. Undeclared periodic triggers are especially risky in a sync skill because they can repeatedly exfiltrate updated memory or state without ongoing user interaction.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Automatic scheduled task creation and persistent cron configuration would introduce stealthy persistence not disclosed by the manifest. Undeclared periodic triggers are especially risky in a sync skill because they can repeatedly exfiltrate updated memory or state without ongoing user interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script performs a forced push to the remote main branch, which can overwrite repository history and destroy existing remote content without confirmation. If the configured repository is shared, reused, or mistyped, this can cause irreversible data loss and disrupt other users or automation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The command constructs a shell string containing a user-controlled repository URL with an embedded token and passes it to execSync. Although the hostname is allowlisted, the URL is not safely escaped for shell execution, and the use of --force magnifies impact by enabling destructive remote operations if configuration is abused or misdirected.

Content

Scanner excerpt · claw-sync/scripts/push.js (reported line 253)May include surrounding context.

js
safeExec(`git commit -m "${commitMsg}"`, { stdio: 'ignore' });

    // Push to main
    safeExec(`git push ${repoUrl} HEAD:main --force`, { stdio: 'pipe' });

    // Create version tag
    safeExec(`git tag ${tagName}`, { stdio: 'ignore' });

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · claw-sync/config.example.env (reported line 7)May include surrounding context.

text
# Your private GitHub repository URL
BACKUP_REPO=https://github.com/username/openclaw-backup

# GitHub Fine-Grained Personal Access Token
# Required permissions: Contents (Read and Write)
# Generate at: https://github.com/settings/tokens?type=beta
BACKUP_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxx

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.env (reported line 7)May include surrounding context.

text
# Your private GitHub repository URL
BACKUP_REPO=https://github.com/username/openclaw-backup

# GitHub Fine-Grained Personal Access Token
# Required permissions: Contents (Read and Write)
# Generate at: https://github.com/settings/tokens?type=beta
BACKUP_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxx

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The script constructs a shell command with an attacker-controllable repository URL containing an embedded token and executes it via execSync. Although hostname/protocol are validated, shell metacharacters can still appear in other URL components, creating command-injection risk, and the use of '--force' can also overwrite remote history, amplifying damage if the destination is wrong or manipulated.

Content

Scanner excerpt · scripts/push.js (reported line 253)May include surrounding context.

js
safeExec(`git commit -m "${commitMsg}"`, { stdio: 'ignore' });

    // Push to main
    safeExec(`git push ${repoUrl} HEAD:main --force`, { stdio: 'pipe' });

    // Create version tag
    safeExec(`git tag ${tagName}`, { stdio: 'ignore' });

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · claw-sync/scripts/status.js (reported line 95)May include surrounding context.

js
}

  console.log('');
  console.log('🔒 NOT synced (security): openclaw.json, .env');

  // Local backups
  console.log('\n💾 Local backups (disaster recovery):');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/status.js (reported line 95)May include surrounding context.

js
}

  console.log('');
  console.log('🔒 NOT synced (security): openclaw.json, .env');

  // Local backups
  console.log('\n💾 Local backups (disaster recovery):');

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README encourages syncing memory files and custom skills to a remote repository but does not prominently warn that these files may contain sensitive personal, operational, or proprietary data. Even though it excludes a few secret files, users could still unintentionally upload sensitive content embedded in the synced markdown files or skills.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Setup

Create ~/.openclaw/.backup.env:

bash
BACKUP_REPO=https://github.com/yourusername/your-sync-repo

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Setup

Create ~/.openclaw/.backup.env:

bash
BACKUP_REPO=https://github.com/yourusername/your-sync-repo

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · claw-sync/README.md (reported line 70)May include surrounding context.

Setup

Create ~/.openclaw/.backup.env:

bash
BACKUP_REPO=https://github.com/yourusername/your-sync-repo

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The restore commands are presented as routine operations without a clear warning that restore will overwrite local memory and skill files with remote versions. This creates a real risk of accidental data loss, rollback to malicious or stale content, or unintentional replacement of local customizations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares no permissions or allowed-tools despite clearly requiring access to environment/config secrets and likely networked operations. Missing scope declarations hide sensitive capabilities from users and policy layers, increasing the chance that secret-bearing environment data or remote access is granted without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The restore command can overwrite local memory and skills, but the documentation does not prominently warn about destructive local data replacement. Because the synced content includes identity, rules, logs, and custom skills, an unexpected restore could cause material data loss or integrity issues.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The --force option skips confirmation for a destructive restore operation, reducing user oversight for an action that can overwrite local state. In a backup/restore context this is not inherently malicious, but it increases the chance of accidental or scripted misuse causing irreversible local changes.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

/restore → Restore latest version /restore latest → Same as above /restore backup-20260202-1430 → Restore specific version /restore latest --force → Skip confirmation

text

### /sync-status

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises restore operations, including force-restore, without a prominent warning that these commands overwrite local memory and skill files. In a sync/backup skill, unclear documentation can directly lead users to destroy or replace local state unintentionally, especially because restore targets high-value agent data such as memory and installed skills.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Documenting a --force option as merely 'Skip confirmation' normalizes bypassing the last safeguard before an overwrite operation. In the context of restoring workspace memory and skills, this increases the chance of accidental destructive actions and could enable silent replacement of trusted local state if the command is invoked by another agent or script.

Content

Scanner excerpt · claw-sync/README.md (reported line 86)May include surrounding context.

md
| `/restore` | Restore latest version |
| `/restore latest` | Same as above |
| `/restore backup-20260202-1430` | Restore specific version |
| `/restore --force` | Skip confirmation |
| `/sync-list` | List all available versions |
| `/sync-status` | Show config and local backups |

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill is explicitly designed to create persistent remote storage of OpenClaw memory and workspace data in a hosted repository. While this persistence is functional intent, it materially increases exposure because sensitive agent/user state is retained outside the local environment and may be accessed if the repository or token is compromised.

Content

Scanner excerpt · claw-sync/SKILL.md (reported line 80)May include surrounding context.

git clone https://github.com/arakichanxd/Claw-Sync.git claw-sync

text

### Step 2: Create a GitHub repository
1. Go to https://github.com/new
2. Create a **private** repository (e.g., `my-openclaw-sync`)
3. Leave it empty (no README)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents syncing memory, identity, tools, daily logs, and custom skills to a remote repository, but it does not prominently warn that these files may contain highly sensitive personal, operational, or agent-internal data. Users may enable sync under the assumption it is routine backup behavior without understanding the privacy and data exfiltration implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The restore documentation explains how to pull remote data but does not clearly warn that restore can overwrite local memory and skills, potentially replacing trusted local state with older or compromised remote content. This increases the risk of accidental destructive actions and recovery from an untrusted or stale snapshot.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
claw-sync/index.js:53

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
claw-sync/scripts/pull.js:111

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
claw-sync/scripts/push.js:140

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:53

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/pull.js:111

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/push.js:140