Security audit

Avenger Initiative

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real backup-and-restore tool, but it moves broad OpenClaw state to GitHub and restores active cron and skill files with too little scoping and several unsafe handling practices.

Review before installing. Use only a private, dedicated GitHub vault, assume memories, prompts, custom skills, and cron definitions will be stored in plaintext, and avoid restoring from a vault branch unless you trust its exact contents. The setup token handling and restore behavior should be fixed before use in a sensitive environment.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:95
Finding: GitHub Authentication Token Exposed Through Credential-Bearing Clone URL
Content: View full analysis
` and its credential-bearing Git configuration on disk. This behavior also conflicts with the project's security statement that the GitHub token is used through the GitHub CLI and is never stored by the Skill. ### Attack Path 1. A local attacker monitors process arguments while setup is running, or waits for setup to fail after cloning. 2. The attacker reads the token from the process command line or from `/tmp/avenger-setup-/.git/config`. 3. The attacker submits the recovered token to GitHub. 4. GitHub resources accessible under the token's scopes can then be enumerated, read, or modified. ### Impact Assessment An attacker may obtain the privileges granted to the user's GitHub CLI token. Depending on its scopes, this can include: - Reading private repositories. - Modifying or deleting repository content. - Injecting malicious content into backup vaults. - Accessing other organization or a ...[truncated 206 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/security.md:25
Finding: Key Rotation Procedure Uses Predictable Plaintext Secret Files
Content: View full analysis
/tmp/new.key # 2. Decrypt with old key OLD_KEY=$(cat ~/.openclaw/credentials/avenger.key) openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 \ -pass "pass:$OLD_KEY" \ -in config/openclaw.json.enc \ -out /tmp/openclaw_plain.json # 3. Re-encrypt with new key NEW_KEY=$(cat /tmp/new.key) openssl enc -aes-256-cbc -pbkdf2 -iter 100000 \ -pass "pass:$NEW_KEY" \ -in /tmp/openclaw_plain.json \ -out config/openclaw.json.enc # 4. Install new key cp /tmp/new.key ~/.openclaw/credentials/avenger.key rm /tmp/new.key /tmp/openclaw_plain.json ``` ### Technical Analysis The documented key-rotation process writes two highly sensitive files to fixed paths in the shared `/tmp` directory: - `/tmp/new.key`, containing the replacement encryption key. - `/tmp/openclaw_plain.json`, containing decrypted API keys, bot tokens, and configuration secrets. The procedure does not: - Set a restrictive `umask`. - Create a private temporary directory. - Use unpredictable names generated by `mktemp`. - Check for pre-existing files or symbolic links. - Install an interruption-safe cleanup trap. - Securely control file ownership and permissions before writing. Shell redirection opens the target path before `openssl` runs. This makes the workflow vulnerable to predictable-file races and symbolic-link attacks in environments where `/tmp` is shared. If the process is interrupted, the plaintext configuration and new key may remain on disk indefinitely. ### Attack Path 1. A local attacker predicts the documented fixed paths. 2. The attacker monitors `/tmp`, opens the generated files when permissions permit, or pre-creates malicious links at those paths. 3. During rotation, the new encryption key and decrypte ...[truncated 748 chars]
Remediation: View remediation
"$NEW_KEY_FILE" OLD_KEY=$(cat "$HOME/.openclaw/credentials/avenger.key") openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 \ -pass "pass:$OLD_KEY" \ -in config/openclaw.json.enc \ -out "$PLAIN_FILE" NEW_KEY=$(cat "$NEW_KEY_FILE") openssl enc -aes-256-cbc -pbkdf2 -iter 100000 \ -pass "pass:$NEW_KEY" \ -in "$PLAIN_FILE" \ -out config/openclaw.json.enc install -m 600 "$NEW_KEY_FILE" \ "$HOME/.openclaw/credentials/avenger.key" ``` Also validate ownership and permissions of the credentials directory and avoid displaying either key in logs. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/restore.sh:43
Finding: Unverified Remote Vault Content Is Installed into Executable and Persistent OpenClaw Paths
Content: View full analysis
/dev/null)" ]; then mkdir -p "$WORKSPACE_DIR/skills" for skill_dir in skills/*/; do skill_name=$(basename "$skill_dir") mkdir -p "$WORKSPACE_DIR/skills/$skill_name" cp -r "$skill_dir"* "$WORKSPACE_DIR/skills/$skill_name/" 2>/dev/null || true done log " ✓ skills" fi ``` ### Technical Analysis The restore process trusts the current contents of a mutable Git repository and copies them into active OpenClaw control paths. It performs no cryptographic manifest verification, trusted-commit allow-listing, signed-commit verification, checksum comparison, or per-component provenance validation. The generic overwrite confirmation does not show a file-level diff or distinguish ordinary user data from executable or persistent content. Two particularly sensitive classes of remote content are restored: - `config/cron-jobs.json`, which can define future system events and persi ...[truncated 1458 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:41
Finding: Plaintext Sensitive OpenClaw Data Can Be Uploaded Without Enforcing Private Repository Visibility
Content: View full analysis
/dev/null 2>&1 || fail "Cannot access: $VAULT_REPO — check URL and permissions" log " ✓ Repo accessible" ``` The backup then copies cron, memory, Agent, and Skill content without encryption: ```bash [ -f "$OPENCLAW_DIR/cron/jobs.json" ] && \ cp "$OPENCLAW_DIR/cron/jobs.json" "config/cron-jobs.json" && log " ✓ cron jobs" BACKED=0 for f in "$WORKSPACE_DIR"/*.md; do [ -f "$f" ] || continue cp "$f" "workspace/$(basename "$f")" BACKED=$((BACKED+1)) done COUNT=0 for mf in "$WORKSPACE_DIR/memory"/*.md; do [ -f "$mf" ] || continue cp "$mf" "workspace/memory/$(basename "$mf")" COUNT=$((COUNT+1)) done for ws in $AGENT_DIRS; do agent_name=$(basename "$ws" | sed 's/workspace-//') COUNT=0 for f in SOUL.md IDENTITY.md MEMORY.md HEARTBEAT.md TOOLS.md AGENTS.md USER.md BOOTSTRAP.md; do [ -f "$ws/$f" ] && cp "$ws/$f" "agents/$agent_name/$f" && COUNT=$((COUNT+1)) || true done done if [ -d "$SKILLS_DIR" ]; then SKILL_COUNT=0 for skill_dir in "$SKILLS_DIR"/*/; do skill_name=$(basename "$skill_dir") mkdir -p "skills/$skill_name" [ -f "$skill_dir/SKILL.md" ] && cp "$skill_dir/SKILL.md" "skills/$skill_name/" [ -d "$skill_dir/scripts" ] && cp -r "$skill_dir/scripts" "skills/$skill_name/" 2>/dev/null || true [ -d "$skill_dir/references" ] && cp -r "$skill_dir/references" "skills/$skill_name/" 2>/dev/null || true SKILL_COUNT=$((SKILL_COUNT+1)) done fi ``` All staged content is pushed to the configured destination: ```bash g ...[truncated 1944 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill makes extensive claims about encrypted backups, retention, restore behavior, and automatic triggers, but the markdown shown does not provide verifiable implementation details or permission declarations for those capabilities. That mismatch is dangerous because users may trust security guarantees and automation boundaries that are not actually enforced, especially for backup, restore, and GitHub operations affecting sensitive system state.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Silently backing up sensitive files and memories after configuration changes bypasses meaningful user review at the moment data leaves the system. In context, the destination is an external GitHub repository, so this is effectively an automated exfiltration mechanism triggered by normal system administration.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly directs the backup of memory logs, workspace files, per-agent files, custom skills, and cron definitions to a GitHub vault. Even if one config file is encrypted, these other artifacts can contain credentials, prompts, tokens, personal data, operational details, or sensitive conversational history, creating a substantial external data leakage channel.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/security.md (reported line 44)May include surrounding context.
md
# 4. Install new key cp /tmp/new.key ~/.openclaw/credentials/avenger.key rm /tmp/new.key /tmp/openclaw_plain.json # 5. Commit updated vault cd /path/to/vault && git add config/openclaw.json.enc && git commit -m "🔐 Key rotation" && git push

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/backup.sh (reported line 278)May include surrounding context.
sh
cat > .gitignore << 'GITIGNORE' *.key *.pem .env credentials/ node_modules/ __pycache__/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/backup.sh (reported line 295)May include surrounding context.
sh
exit 0 fi git commit -m "$COMMIT_MSG" --quiet git push origin main --quiet log " ✓ main updated" # ---- Create dated snapshot branch from current main ------

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 84% confidence
Finding: This command force-pushes a weekly snapshot branch, which can overwrite remote history without confirmation. In a backup system, destructive remote writes reduce auditability and can erase prior evidence or recovery points if the branch name collides or the local state is wrong, making the context more dangerous because backups should preserve integrity.
Content: Scanner excerpt · scripts/backup.sh (reported line 308)May include surrounding context.
sh
if [ "$DOW" = "7" ]; then WEEKLY_BRANCH="backup/weekly/$WEEK" git checkout -b "$WEEKLY_BRANCH" --quiet 2>/dev/null || git checkout "$WEEKLY_BRANCH" --quiet git push origin "$WEEKLY_BRANCH" --force --quiet git checkout main --quiet log " ✓ Weekly: $WEEKLY_BRANCH" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 84% confidence
Finding: Like the weekly snapshot, this monthly backup uses force-push and can overwrite remote history for a retention branch intended to preserve long-term backups. In backup tooling this undermines integrity guarantees and could silently destroy the very restore points users rely on.
Content: Scanner excerpt · scripts/backup.sh (reported line 317)May include surrounding context.
sh
if [ "$DOM" = "01" ]; then MONTHLY_BRANCH="backup/monthly/$MONTH" git checkout -b "$MONTHLY_BRANCH" --quiet 2>/dev/null || git checkout "$MONTHLY_BRANCH" --quiet git push origin "$MONTHLY_BRANCH" --force --quiet git checkout main --quiet log " ✓ Monthly: $MONTHLY_BRANCH" fi

Chaining Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The cleanup line executes a command from the value of CLEANUP_VAULT as if it were a program, then conditionally runs rm -rf on a path in /tmp. This is brittle and dangerous shell logic: if the boolean-like variable is ever influenced unexpectedly, or if cleanup state drifts from assumptions, the script may execute unintended commands or recursively delete an unsafe path. In a restore skill that pulls remote content and handles filesystem state, unsafe deletion logic is more dangerous because it runs with the user's local file permissions and targets dynamically constructed paths.
Content: Scanner excerpt · scripts/restore.sh (reported line 130)May include surrounding context.
sh
fi # ---- Cleanup ---------------------------------------------- $CLEANUP_VAULT && rm -rf "$VAULT_DIR" echo "" log "✅ Restore complete from branch: $BRANCH"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/backup.sh (reported line 291)May include surrounding context.
sh
log " ✓ main branch created and pushed" fi cd /; rm -rf "$VAULT_DIR" # ---- Make scripts executable ------------------------------ SKILL_DIR="$OPENCLAW_DIR/workspace/skills/avenger-initiative/scripts"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/backup.sh (reported line 342)May include surrounding context.
sh
log " ✓ main branch created and pushed" fi cd /; rm -rf "$VAULT_DIR" # ---- Make scripts executable ------------------------------ SKILL_DIR="$OPENCLAW_DIR/workspace/skills/avenger-initiative/scripts"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/setup.sh (reported line 144)May include surrounding context.
sh
log " ✓ main branch created and pushed" fi cd /; rm -rf "$VAULT_DIR" # ---- Make scripts executable ------------------------------ SKILL_DIR="$OPENCLAW_DIR/workspace/skills/avenger-initiative/scripts"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The changelog explicitly documents broad trigger phrases such as 'backup system', 'configure backup', and auto-run behavior after critical config changes, which increases the chance of unintended invocation by natural-language overlap or prompt injection through ambient text. In a skill that performs backup and restore operations on sensitive agent state and GitHub vault contents, accidental execution could expose secrets, overwrite state, or trigger destructive restore actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README states that only openclaw.json is encrypted, while 'everything else' including SOUL and MEMORY files is stored in plaintext in a private GitHub repo. Those files can contain highly sensitive secrets, personal data, prompts, operational history, and credentials, so presenting nightly backup without a prominent plaintext warning materially increases the chance of unsafe deployment and data leakage.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 67)May include surrounding context.
Option 3 — Manual

bash
mkdir -p ~/.openclaw/workspace/skills git clone https://github.com/ProSkillsMD/avenger-initiative \ ~/.openclaw/workspace/skills/avenger-initiative chmod +x ~/.openclaw/workspace/skills/avenger-initiative/scripts/*.sh

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell scripts that can write files, access local data, and interact with GitHub, but it declares no explicit tool scope or permissions. This creates an authorization gap where a user or runtime cannot accurately assess the skill's capabilities before execution, increasing the risk of unintended file or network actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad, common language like 'backup system' and 'set up backup', which can match ordinary conversation and activate backup actions unexpectedly. In a skill that shells out and exports data to GitHub, accidental activation materially raises the chance of unauthorized or unintended data movement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction to auto-run after any confirmed config change is ambiguous and overly broad, and it explicitly says to run backup silently. Because the backup includes memories, workspace data, and configuration artifacts, this creates a path for unreviewed exfiltration to an external repository after routine administrative actions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
### Step 1 — Ask for the vault repo > "To set up Avenger Initiative, I need a private GitHub repo to use as your vault. Have you created one already? If so, share the URL (e.g. `https://github.com/yourname/my-vault`). If not, I can help you create one." ### Step 2 — Handle the encryption key

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script copies a large amount of highly sensitive OpenClaw state to a remote GitHub repository while encrypting only openclaw.json. It explicitly backs up plaintext memory logs, agent identity files, skills, and cron configuration, and even generates a README claiming those plaintext contents are 'safe to read directly in GitHub,' which can mislead users into exposing private or operationally sensitive data if the repo is misconfigured, shared, or later made public.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script reads an encryption key from the credentials directory and loads it into a shell variable during preflight. Although failures are logged, there is no explicit user-facing notice that the restore process will access local credentials, and the surrounding comments/header do not disclose that behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: When no vault directory is supplied, the script automatically clones the vault repository via gh repo clone, which performs network communication and may transmit repository and environment context. The script logs the clone target, but the header/usage text does not warn users that restore may fetch data from a remote repository automatically.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 48)May include surrounding context.
sh
# ---- Credentials dir -------------------------------------- mkdir -p "$OPENCLAW_DIR/credentials" chmod 700 "$OPENCLAW_DIR/credentials" # ---- Encryption key --------------------------------------- if [ -n "$PROVIDED_KEY" ]; then

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 79)May include surrounding context.
sh
log " ✓ Generated new key" fi fi chmod 600 "$KEY_FILE" # ---- Save config ------------------------------------------ cat > "$CONFIG_FILE" << JSON

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 90)May include surrounding context.
sh
log " ✓ Generated new key" fi fi chmod 600 "$KEY_FILE" # ---- Save config ------------------------------------------ cat > "$CONFIG_FILE" << JSON

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Ssd 3

Ssd 3

Tool Parameter Abuse

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

Chaining Abuse

Chaining Abuse

Chaining Abuse

Vague Triggers

Missing User Warnings

Session Persistence

Option 3 — Manual

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Session Persistence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Static analysis