Workspace Sync & Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:45 AM UTC
• Version: 2.4.1

Overview

This cloud sync skill is not clearly malicious, but it needs Review because its scripts can install system packages and run destructive sync operations with defaults that do not match the safer documentation.

Install only if you are comfortable with this skill configuring rclone, storing cloud credentials under OpenClaw state, and syncing local files with your cloud account. Review the scripts before running setup, avoid unattended package installation, set an explicit mode and dedicated remote subfolder, run dry-run first, and do not use --resync or restore unless you have verified both sides and have a recoverable backup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync.sh:14
• Finding: Unsafe and Destructive Cloud Synchronization Defaults<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/sync.sh:14` - `scripts/sync.sh:83-103` - `scripts/setup.sh:147-150` - `SKILL.md:8-20` **Vulnerability Type**: Unsafe synchronization configuration and destructive default behavior **Risk Level**: High ### Complete Code Snippets `scripts/sync.sh:14` silently selects bidirectional synchronization: ```sh DIRECTION="bisync" ``` `scripts/sync.sh:83-103` disables bisync safety checks and uses destructive `rclone sync` operations for both one-way directions: ```sh case "$DIRECTION" in bisync) # Bisync: bidirectional sync # shellcheck disable=SC2086 rclone bisync "$LOCAL_DIR" "$REMOTE" \ $RCLONE_COMMON \ $RESYNC \ --remove-empty-dirs \ --check-access=false \ --no-check-dest \ 2>&1 ;; push) # Push: local -> remote (one-way) # shellcheck disable=SC2086 rclone sync "$LOCAL_DIR" "$REMOTE" \ $RCLONE_COMMON \ --remove-empty-dirs \ 2>&1 ;; pull) # Pull: remote -> local (one-way) # shellcheck disable=SC2086 rclone sync "$REMOTE" "$LOCAL_DIR" \ $RCLONE_COMMON \ --remove-empty-dirs \ 2>&1 ;; ``` `scripts/setup.sh:147-150` recommends an immediate resync as the first operation: ```sh log "Setup complete." log "Next steps:" log " 1. Run first sync: sh scripts/sync.sh --resync" log " 2. Check status: sh scripts/status.sh" ``` `SKILL.md:8-20` claims that a mode is required and recommends mailbox mode, which is inconsistent with the supplied script's implicit bisync default: ```md Sync the agent workspace with cloud storage. `mode` is required — choose `mailbox` (inbox/outbox, safest), `mirror` (remote->local), or `bisync` (bidirectional, advanced). ## Trigger Use this skill when the user asks to: - Sync workspace to/from cloud - Back up workspace files - Check sync status - Fix sync issues - Send files to the agent workspace ## Sync modes | Mode | Direction | Description | |-- ...[truncated 3697 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the implicit bisync default. Require `--direction` or an explicit synchronization mode and reject execution when it is absent. 2. Default to a dry run or a non-destructive mailbox/copy workflow rather than bidirectional synchronization. 3. Do not recommend `--resync` as the normal first operation. Require an explicit warning and interactive confirmation before resync. 4. Remove `--check-access=false` and `--no-check-dest` unless a documented, provider-specific reason requires them. 5. Require `--dry-run` before destructive `sync`, `bisync`, or `--resync` operations, and display the proposed changes before confirmation. 6. For additive transfer semantics, use `rclone copy` instead of `rclone sync`. If deletion is intended, clearly identify it and require explicit authorization. 7. Reject the remote root as a default target. Require a dedicated, non-empty remote subdirectory and validate both local and remote path scope. 8. Detect dangerous local targets such as `/`, the workspace root, or a home directory and require additional confirmation. 9. Create or verify a recoverable backup before destructive synchronization. 10. Align the documentation with the implementation. Either implement the documented mailbox mode or remove claims that it is provided by these scripts. 11. Add automated tests covering destination-only files, unavailable remotes, empty paths, first-run resync, dry-run behavior, and interrupted synchronization. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

External Script Fetching

High

• Category: Supply Chain

Content

openclaw workspace-sync setup
```

The setup wizard will only attempt installation via your detected OS package manager (brew/apt/dnf/yum/pacman/apk) — it will never use `curl | sudo sh`.

### "requires --resync" (bisync only)
Bisync state was lost. **Before running `--resync`, verify both sides are correct**:

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Chaining Abuse

High

• Category: Tool Misuse

Content

openclaw workspace-sync setup
```

The setup wizard will only attempt installation via your detected OS package manager (brew/apt/dnf/yum/pacman/apk) — it will never use `curl | sudo sh`.

### "requires --resync" (bisync only)
Bisync state was lost. **Before running `--resync`, verify both sides are correct**:

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

brew install rclone
  elif [ "$OS" = "Linux" ] && command -v apt-get >/dev/null 2>&1; then
    log "Installing via apt-get..."
    sudo apt-get update && sudo apt-get install -y rclone
  elif [ "$OS" = "Linux" ] && command -v dnf >/dev/null 2>&1; then
    log "Installing via dnf..."
    sudo dnf install -y rclone

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone

• Confidence: 95% confidence
• Finding: The --noconfirm flag is an abuse-prone parameter because it disables interactive review for a privileged package-management action. In this skill, that makes accidental or agent-driven host modification easier and removes a key safety barrier.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

$RESYNC \
      --remove-empty-dirs \
      --check-access=false \
      --no-check-dest \
      2>&1
    ;;
  push)

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger language is broad enough to match common requests like backup, send files, or fix sync issues, which can cause the skill to activate in situations the user did not intend. In a skill that can move data to cloud storage or restore state, ambiguous activation raises the risk of unintended data transfer or destructive operations.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install rclone

# Debian/Ubuntu
sudo apt-get install rclone

# Fedora
sudo dnf install rclone

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install rclone

# Debian/Ubuntu
sudo apt-get install rclone

# Fedora
sudo dnf install rclone

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install rclone

# Debian/Ubuntu
sudo apt-get install rclone

# Fedora
sudo dnf install rclone

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo pacman -S rclone

# Alpine
sudo apk add rclone
```

For other platforms, see https://rclone.org/install/

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo pacman -S rclone

# Alpine
sudo apk add rclone
```

For other platforms, see https://rclone.org/install/

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill manifest and primary description scope the capability as workspace sync, but the document also exposes a distinct backup and restore subsystem. That hidden expansion of capability matters because backup/restore can read, transmit, and overwrite materially broader data than a user or orchestrator may expect from a sync-only skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented backup restore command lacks an explicit warning that restore can overwrite or replace local data. In context, restore is more dangerous than ordinary sync because users may invoke it expecting a safe preview, while it can mutate critical workspace or agent state.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The backup feature extends beyond the workspace into config, cron, and memory, which can contain credentials, schedules, prompts, and sensitive agent state. This materially increases the data exposure surface and creates a mismatch between the advertised purpose of the skill and the actual reach of the documented commands.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The setup script can install software system-wide using privileged package-manager commands, which changes the host outside the workspace and requires trust in OS repositories and the package-manager path resolution. In an agent-skill context, this is risky because running setup has side effects on the user's machine and may trigger elevation prompts or modify the environment unexpectedly.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install rclone
  elif [ "$OS" = "Linux" ] && command -v apt-get >/dev/null 2>&1; then
    log "Installing via apt-get..."
    sudo apt-get update && sudo apt-get install -y rclone
  elif [ "$OS" = "Linux" ] && command -v dnf >/dev/null 2>&1; then
    log "Installing via dnf..."
    sudo dnf install -y rclone

• Confidence: 90% confidence
• Finding: The script invokes sudo apt-get update && sudo apt-get install -y rclone, causing privileged system changes during setup. In a local agent-skill setting, requesting elevation is inherently sensitive because it extends the skill's effect beyond the project workspace.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt-get update && sudo apt-get install -y rclone
  elif [ "$OS" = "Linux" ] && command -v dnf >/dev/null 2>&1; then
    log "Installing via dnf..."
    sudo dnf install -y rclone
  elif [ "$OS" = "Linux" ] && command -v yum >/dev/null 2>&1; then
    log "Installing via yum..."
    sudo yum install -y rclone

• Confidence: 88% confidence
• Finding: The setup performs sudo dnf install -y rclone, which is a privileged package installation on the host. Even when intended for convenience, such elevation increases risk because the skill is no longer confined to the workspace and can alter the broader system state.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo dnf install -y rclone
  elif [ "$OS" = "Linux" ] && command -v yum >/dev/null 2>&1; then
    log "Installing via yum..."
    sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone

• Confidence: 88% confidence
• Finding: The script invokes sudo yum install -y rclone, which performs host-level package installation with elevated privileges. This is dangerous in an agent workflow because a setup helper should not silently cross the boundary from workspace automation into root-level system administration.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone

• Confidence: 96% confidence
• Finding: Using pacman's --noconfirm suppresses an important interactive safety check for a privileged operation. In an agent context, this reduces user oversight and makes autonomous system modification easier, which is dangerous even if the package being installed appears legitimate.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone

• Confidence: 94% confidence
• Finding: The script uses sudo pacman -S --noconfirm rclone, combining privilege elevation with unattended execution. This makes the action especially risky because it both modifies the host and suppresses an opportunity for the user to notice or stop the change.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone
  else
    err "No supported package manager found."
    err "Please install rclone manually: https://rclone.org/install/"

• Confidence: 87% confidence
• Finding: The setup runs sudo apk add rclone, which performs a privileged package installation on Alpine-based systems. In a security review of agent skills, this is a true issue because it expands the trust boundary and can impact the entire machine, not just the project files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs `rclone sync` in both push and pull modes, which can make destructive changes to the destination, and it also writes a last-run marker file. Although it logs the selected direction and paths, it does not explicitly warn the user that `sync` may delete or overwrite destination files, nor does it prompt for confirmation before non-dry-run execution.

Static analysis

No suspicious patterns detected.