Workspace Sync & Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:45 AM UTC
• Version: 2.4.1

Overview

This cloud sync skill is not clearly malicious, but it needs Review because its scripts can install system packages and run destructive sync operations with defaults that do not match the safer documentation.

Install only if you are comfortable with this skill configuring rclone, storing cloud credentials under OpenClaw state, and syncing local files with your cloud account. Review the scripts before running setup, avoid unattended package installation, set an explicit mode and dedicated remote subfolder, run dry-run first, and do not use --resync or restore unless you have verified both sides and have a recoverable backup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync.sh:14

Finding

Unsafe and Destructive Cloud Synchronization Defaults

Content

View full analysis

&1 ;; push) # Push: local -> remote (one-way) # shellcheck disable=SC2086 rclone sync "$LOCAL_DIR" "$REMOTE" \ $RCLONE_COMMON \ --remove-empty-dirs \ 2>&1 ;; pull) # Pull: remote -> local (one-way) # shellcheck disable=SC2086 rclone sync "$REMOTE" "$LOCAL_DIR" \ $RCLONE_COMMON \ --remove-empty-dirs \ 2>&1 ;; ``` `scripts/setup.sh:147-150` recommends an immediate resync as the first operation: ```sh log "Setup complete." log "Next steps:" log " 1. Run first sync: sh scripts/sync.sh --resync" log " 2. Check status: sh scripts/status.sh" ``` `SKILL.md:8-20` claims that a mode is required and recommends mailbox mode, which is inconsistent with the supplied script's implicit bisync default: ```md Sync the agent workspace with cloud storage. `mode` is required — choose `mailbox` (inbox/outbox, safest), `mirror` (remote->local), or `bisync` (bidirectional, advanced). ## Trigger Use this skill when the user asks to: - Sync workspace to/from cloud - Back up workspace files - Check sync status - Fix sync issues - Send files to the agent workspace ## Sync modes | Mode | Direction | Description | |-- ...[truncated 3697 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

openclaw workspace-sync setup

text

The setup wizard will only attempt installation via your detected OS package manager (brew/apt/dnf/yum/pacman/apk) — it will never use `curl | sudo sh`.

### "requires --resync" (bisync only)
Bisync state was lost. **Before running `--resync`, verify both sides are correct**:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

openclaw workspace-sync setup

text

The setup wizard will only attempt installation via your detected OS package manager (brew/apt/dnf/yum/pacman/apk) — it will never use `curl | sudo sh`.

### "requires --resync" (bisync only)
Bisync state was lost. **Before running `--resync`, verify both sides are correct**:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 36)May include surrounding context.

sh

brew install rclone
  elif [ "$OS" = "Linux" ] && command -v apt-get >/dev/null 2>&1; then
    log "Installing via apt-get..."
    sudo apt-get update && sudo apt-get install -y rclone
  elif [ "$OS" = "Linux" ] && command -v dnf >/dev/null 2>&1; then
    log "Installing via dnf..."
    sudo dnf install -y rclone

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The --noconfirm flag is an abuse-prone parameter because it disables interactive review for a privileged package-management action. In this skill, that makes accidental or agent-driven host modification easier and removes a key safety barrier.

Content

Scanner excerpt · scripts/setup.sh (reported line 45)May include surrounding context.

sh

sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/sync.sh (reported line 84)May include surrounding context.

sh

$RESYNC \
      --remove-empty-dirs \
      --check-access=false \
      --no-check-dest \
      2>&1
    ;;
  push)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger language is broad enough to match common requests like backup, send files, or fix sync issues, which can cause the skill to activate in situations the user did not intend. In a skill that can move data to cloud storage or restore state, ambiguous activation raises the risk of unintended data transfer or destructive operations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

brew install rclone

# Debian/Ubuntu
sudo apt-get install rclone

# Fedora
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

brew install rclone

# Debian/Ubuntu
sudo apt-get install rclone

# Fedora
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

brew install rclone

# Debian/Ubuntu
sudo apt-get install rclone

# Fedora
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

sudo pacman -S rclone

Alpine

sudo apk add rclone

text

For other platforms, see https://rclone.org/install/

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

sudo pacman -S rclone

Alpine

sudo apk add rclone

text

For other platforms, see https://rclone.org/install/

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill manifest and primary description scope the capability as workspace sync, but the document also exposes a distinct backup and restore subsystem. That hidden expansion of capability matters because backup/restore can read, transmit, and overwrite materially broader data than a user or orchestrator may expect from a sync-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented backup restore command lacks an explicit warning that restore can overwrite or replace local data. In context, restore is more dangerous than ordinary sync because users may invoke it expecting a safe preview, while it can mutate critical workspace or agent state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The backup feature extends beyond the workspace into config, cron, and memory, which can contain credentials, schedules, prompts, and sensitive agent state. This materially increases the data exposure surface and creates a mismatch between the advertised purpose of the skill and the actual reach of the documented commands.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup script can install software system-wide using privileged package-manager commands, which changes the host outside the workspace and requires trust in OS repositories and the package-manager path resolution. In an agent-skill context, this is risky because running setup has side effects on the user's machine and may trigger elevation prompts or modify the environment unexpectedly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script invokes sudo apt-get update && sudo apt-get install -y rclone, causing privileged system changes during setup. In a local agent-skill setting, requesting elevation is inherently sensitive because it extends the skill's effect beyond the project workspace.

Content

Scanner excerpt · scripts/setup.sh (reported line 36)May include surrounding context.

sh

brew install rclone
  elif [ "$OS" = "Linux" ] && command -v apt-get >/dev/null 2>&1; then
    log "Installing via apt-get..."
    sudo apt-get update && sudo apt-get install -y rclone
  elif [ "$OS" = "Linux" ] && command -v dnf >/dev/null 2>&1; then
    log "Installing via dnf..."
    sudo dnf install -y rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The setup performs sudo dnf install -y rclone, which is a privileged package installation on the host. Even when intended for convenience, such elevation increases risk because the skill is no longer confined to the workspace and can alter the broader system state.

Content

Scanner excerpt · scripts/setup.sh (reported line 39)May include surrounding context.

sh

sudo apt-get update && sudo apt-get install -y rclone
  elif [ "$OS" = "Linux" ] && command -v dnf >/dev/null 2>&1; then
    log "Installing via dnf..."
    sudo dnf install -y rclone
  elif [ "$OS" = "Linux" ] && command -v yum >/dev/null 2>&1; then
    log "Installing via yum..."
    sudo yum install -y rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script invokes sudo yum install -y rclone, which performs host-level package installation with elevated privileges. This is dangerous in an agent workflow because a setup helper should not silently cross the boundary from workspace automation into root-level system administration.

Content

Scanner excerpt · scripts/setup.sh (reported line 42)May include surrounding context.

sh

sudo dnf install -y rclone
  elif [ "$OS" = "Linux" ] && command -v yum >/dev/null 2>&1; then
    log "Installing via yum..."
    sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

Using pacman's --noconfirm suppresses an important interactive safety check for a privileged operation. In an agent context, this reduces user oversight and makes autonomous system modification easier, which is dangerous even if the package being installed appears legitimate.

Content

Scanner excerpt · scripts/setup.sh (reported line 45)May include surrounding context.

sh

sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The script uses sudo pacman -S --noconfirm rclone, combining privilege elevation with unattended execution. This makes the action especially risky because it both modifies the host and suppresses an opportunity for the user to notice or stop the change.

Content

Scanner excerpt · scripts/setup.sh (reported line 45)May include surrounding context.

sh

sudo yum install -y rclone
  elif [ "$OS" = "Linux" ] && command -v pacman >/dev/null 2>&1; then
    log "Installing via pacman..."
    sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The setup runs sudo apk add rclone, which performs a privileged package installation on Alpine-based systems. In a security review of agent skills, this is a true issue because it expands the trust boundary and can impact the entire machine, not just the project files.

Content

Scanner excerpt · scripts/setup.sh (reported line 48)May include surrounding context.

sh

sudo pacman -S --noconfirm rclone
  elif [ "$OS" = "Linux" ] && command -v apk >/dev/null 2>&1; then
    log "Installing via apk..."
    sudo apk add rclone
  else
    err "No supported package manager found."
    err "Please install rclone manually: https://rclone.org/install/"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script performs rclone sync in both push and pull modes, which can make destructive changes to the destination, and it also writes a last-run marker file. Although it logs the selected direction and paths, it does not explicitly warn the user that sync may delete or overwrite destination files, nor does it prompt for confirmation before non-dry-run execution.

Content

No source excerpt is available for this finding.