Daily Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:59 AM UTC
• Version: 1.9.2

Overview

This is a disclosed Git backup skill, but it can automatically commit and push workspace data with weak scoping controls.

Review this before installing. Use it only with a private, access-controlled remote; require AGENT_WORKSPACE to be explicitly set; add a .gitignore/allowlist and secret scan before any commit or push; and have the agent show the exact staged files before scheduled backups run.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:21

Finding

Unfiltered workspace changes may be committed and uploaded to a remote repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-25
Vulnerability Type: Missing sensitive-file filtering before Git commit and push
Risk Level: High

Evidence

markdown

## Core Workflow

1. Run pre-flight-check.sh to inspect the current workspace
2. Act according to the result (NOT_GIT_REPO → git init, NO_CHANGES → skip, HAS_CHANGES → commit changes in content-based groups and push)
3. If the remote has not been created, follow references/spec.md

The snippet above is a faithful English rendering of the relevant source instructions.

Technical Analysis

The documented workflow instructs the Agent to commit and push workspace changes without requiring a sensitive-file review, secret scan, staging allowlist, or user approval of the exact files being uploaded. Agent workspaces may contain environment files, API tokens, private keys, credentials, local state, memory data, execution logs, or other material that should not leave the local system.

Remote transfer is necessary for backup functionality, but committing every detected change is broader than the minimum privilege and data scope required. Git also preserves committed secrets in repository history even if they are removed in a later commit.

Attack Path

1. A credential, private configuration file, token-bearing log, or other sensitive artifact is created or modified inside the workspace.
2. The pre-flight script reports HAS_CHANGES.
3. The Agent follows the Skill instructions and stages the workspace changes without a mandatory sensitive-file check.
4. The Agent commits and pushes the changes to the configured remote repository.
5. The sensitive data becomes accessible to remote-repository users and remains recoverable from Git history.

Impact Assessment

Exploitation can disclose any sensitive material readable within the selected workspace. Depending on the exposed data, this may allow access to source repositori ...[truncated 221 chars]

Remediation

View remediation

Remediation Suggestions

• Require a secret scan before any git add, commit, or push operation.
• Use an explicit backup allowlist instead of staging the complete workspace.
• Exclude private keys, environment files, credential stores, Agent memory, execution logs, and platform-specific secret files by default.
• Maintain a secure .gitignore template and verify ignored files with git check-ignore.
• Present the exact staged file list to the user or calling Agent before committing.
• Block the push when high-confidence credentials are detected and provide instructions for secret rotation and Git-history cleanup.
• Prefer a private, access-controlled remote repository with narrowly scoped credentials.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/pre-flight-check.sh:6

Finding

Hard-coded workspace fallback can operate on an unintended Agent workspace

Content

View full analysis

Vulnerability Details

File Location: scripts/pre-flight-check.sh, lines 6-10
Vulnerability Type: Fail-open workspace selection and cross-workspace access
Risk Level: Medium

Evidence

bash

AGENT_WORKSPACE="${AGENT_WORKSPACE:-/home/axelhu/.openclaw/workspace-main}"
LOG_DIR="$AGENT_WORKSPACE/data/exec-logs/daily-backup"
TODAY=$(date +%Y-%m-%d)

mkdir -p "$LOG_DIR"
cd "$AGENT_WORKSPACE" || exit 1

Technical Analysis

The Skill declares that it backs up only the current Agent's session workspace, supplied through AGENT_WORKSPACE. However, the script silently selects /home/axelhu/.openclaw/workspace-main when that environment variable is absent.

This fail-open behavior breaks the documented workspace boundary. The script also performs mkdir -p before validating that the path is the authorized current-session workspace or even confirming that it is a Git repository. If invoked under an account with access to multiple Agent workspaces, it may create directories and inspect repository state in a workspace unrelated to the caller.

The LOG_DIR is not otherwise used, so this filesystem write is unnecessary for the declared pre-flight status-check function.

Attack Path

1. The Skill is invoked without AGENT_WORKSPACE, whether through configuration error, an incomplete scheduled task, or a manipulated execution environment.
2. The script silently selects the embedded /home/axelhu/.openclaw/workspace-main path.
3. It creates data/exec-logs/daily-backup in that workspace.
4. It changes into the unintended workspace and executes Git status operations.
5. Changed filenames and repository state from that workspace are returned to the caller.
6. If the broader workflow continues based on this result, the Agent may initialize, commit, or push the wrong workspace.

Impact Assessment

The immediate script can create directories and disclose repository status and filenames in an un ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hard-coded fallback and terminate with an error when AGENT_WORKSPACE is unset or empty.
• Resolve the path with realpath and verify it exactly matches the workspace authorized for the current session.
• Reject symbolic-link traversal and paths outside the approved workspace root.
• Perform all validation before creating directories or reading repository state.
• Remove LOG_DIR, TODAY, and mkdir -p if logging is not actually required.
• If logging is needed, use a validated, dedicated runtime directory outside the repository with restrictive permissions.
• Ensure scheduled tasks always pass an explicit workspace identifier and run under an account restricted to that workspace.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/pre-flight-check.sh:39

Finding

Pre-flight output unnecessarily exposes changed filenames

Content

View full analysis

Vulnerability Details

File Location: scripts/pre-flight-check.sh, lines 39-42
Vulnerability Type: Excessive information disclosure
Risk Level: Low

Evidence

bash

# Output the changed-file list, limited to 30 entries
echo "---FILES---"
echo "$CHANGES" | head -30
exit 0

The comment above is an English rendering of the source comment; the executable commands are reproduced verbatim.

Technical Analysis

The declared pre-flight purpose can be fulfilled by returning whether changes exist and reporting aggregate counts. The script additionally prints up to 30 changed paths. Filenames can reveal customer names, internal project structure, secret locations, unreleased features, incident details, or other sensitive metadata.

This output is especially risky because the Skill supports scheduled operation and optional report delivery. A calling Agent may include raw command output in logs, prompts, or external messaging reports, extending disclosure beyond the local workspace.

Attack Path

1. A file with a sensitive or revealing name is added, modified, or deleted.
2. git status --porcelain places that path in CHANGES.
3. The script prints the path in its output.
4. The invoking Agent, scheduler, or logging system captures the output.
5. Raw output is retained in logs or included in a report delivered to an external collaboration service.

Impact Assessment

The issue can disclose up to 30 changed paths per execution to any party able to view execution logs or delivered reports. It does not expose file contents directly, but filename metadata may reveal confidential operational or project information. The scope depends on how the script output is logged and distributed.

Remediation

View remediation

Remediation Suggestions

• Return aggregate counts only in the default mode.
• Place filename output behind an explicit diagnostic option that is disabled for scheduled runs.
• Keep diagnostic output local and prevent it from being included in external reports.
• Redact or hash paths if file-level correlation is necessary.
• Document that raw Git status output may contain sensitive metadata.
• Apply restrictive permissions and retention limits to any logs that capture command output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/spec.md (reported line 25)May include surrounding context.

HostName <实际IP或域名> User git Port 22 IdentityFile ~/.ssh/id_ed25519

text

然后 git remote 设为：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly contemplates automatic git init, commits, and pushes, but does not warn the operator that these actions can create a repository, capture sensitive local files, and modify or publish data to configured remotes. In a cron-triggered backup skill, lack of an explicit warning and confirmation model increases the chance of unintended persistence or exfiltration of user/workspace data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is written in Chinese and presents the skill's behavior in a single language without indicating that users may choose another language or that the skill is region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown content is written entirely in Chinese and provides instructions without indicating that language selection is optional or that the document is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file mixes English headings with Chinese-only operational comments, which imposes a locale/language assumption in the skill artifact without offering any user choice or documenting a justified region-specific requirement. This matches the policy category for language or locale constraints expressed in natural language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.