T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup-restore.js:260- Finding
Shell Command Injection Through User-Controlled Archive and Backup Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
MyOpenClaw Backup Restore
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real backup and restore tool, but it handles credential-bearing backups through unsafe shell commands and an exposed HTTP server, so it should be reviewed carefully before use.
Only use this with backups you created and trust. Do not expose the HTTP server beyond localhost, do not transfer archives over plain HTTP, rotate any tokens exposed through a backup or server URL, and treat restore as equivalent to installing persistent code and credentials into ~/.openclaw.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server.js:129- Finding
Stored Cross-Site Scripting Through Uploaded Archive Filenames
- Content
View full analysis
UI not found'; const backups = listBackups(); const rows = backups.map(b => `${b.filename.endsWith('.zip') ? 'zip' : 'tar.gz'} ${b.filename}${b.sizeHuman}${new Date(b.createdAt).toLocaleString()}Download` + `👁 Dry Run` + `♻️ Restore` + `` + `` + `` ).join(''); html = html .replace('{{TOKEN}}', TOKEN) .replace('{{BACKUP_COUNT}}', String(backups.length)) .replace('{{BACKUP_ROWS}}', backups.length ? rows : 'No backups yet.'); res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', ...SECURE_HEADERS }); res.end(html); } ``` The same response embeds the authentication token in executable ...[truncated 2242 chars]- Remediation
View remediation
`, ampersands, and event-handler payloads, and verify that they appear only as text. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server.js:67- Finding
Cleartext Public HTTP Service Exposes Credential-Bearing Backups and Bearer Tokens
- Content
View full analysis
(f.startsWith('openclaw-backup_') || f.startsWith('pre-restore_')) && (f.endsWith('.tar.gz') || f.endsWith('.zip'))) .map(f => { try { const stat = fs.statSync(path.join(BACKUP_DIR, f)); return { filename: f, size: stat.size, sizeHuman: fmt(stat.size), createdAt: stat.mtime.toISOString(), downloadUrl: `/download/${encodeURIComponent(f)}?token=${TOKEN}`, }; } catch { return null; } }) .filter(Boolean) .sort((a, b) => b.createdAt.localeCompare(a.createdAt)); } function checkAuth(req) { const q = new URL('http://x' + req.url).searchParams.get('token'); const h = (req.headers['authorization'] || '').replace('Bearer ', '').trim(); return q === TOKEN || h === TOKEN; } ``` The service listens on every interface without TLS: ```js server.listen(PORT, '0.0.0.0', () => { console.log(`\n🦞 MyOpenClaw Backup Restore Server v3.0`); console.log(` Token protected | Localhost-only for /backup and /restore`); console.log(` http://localhost:${PORT}/?token=${TOKEN}`); console.log(` ⚠️ Do not expose this port to the internet without TLS.\n`); }); ``` ### Technical Analysis The service binds to `0.0.0.0`, making it reachable on all available network interfaces where host firewall rules permit access. It uses Node's plain HTTP server and does not provide transport encryption. Both the bearer token and backup contents are therefore exposed to passive network observers and active man-in-the-middle attackers. This is especially serious because project documentation confirms that archives contain bot tokens, API ke ...[truncated 1570 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup-restore.js:793- Finding
Untrusted Backup Archives Can Install and Automatically Execute Restored Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (30)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 🦞 MyOpenClaw Backup Restore �?跨平台备份还原工�? > �?[MyClaw.ai](https://myclaw.ai) 开源技能生态提�? **一个命令备份，一个命令还原。支�?Windows、macOS、Linux 互相备份还原�?*
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description claims a built-in HTTP server and 'only requires Node.js,' while the analysis says the code relies on external commands such as tar, unzip, PowerShell, bash, and openclaw CLI and may not implement the advertised server behavior. This mismatch is security-relevant because operators may deploy the skill under false assumptions about its attack surface, dependencies, portability, and review requirements.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/backup-restore.js backup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/server.js --token <secret> [--port 7373] [--backup-dir <dir>]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The quick-start section presents restore commands immediately after backup/list commands, and although a dry-run is shown, it does not prominently warn that restore modifies local state and may overwrite credentials, configuration, and conversation data. In a tool explicitly handling highly sensitive OpenClaw state, understated warning language increases the chance of unsafe operator use and accidental destructive restoration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The HTTP management server section advertises browser-based upload and download of backup archives without placing an immediate privacy warning beside those features. Because the same README elsewhere states backups contain bot tokens, API keys, credentials, and full conversation history, omitting that warning in the network-transfer section materially increases the risk of accidental exposure or insecure sharing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill metadata grants filesystem read/write and network-listen access, but the static finding indicates the documented tool scope does not accurately disclose shell/env capabilities used by the implementation. Undeclared execution capability is dangerous because it expands what the skill can do beyond what reviewers and users can reasonably infer, especially for a backup/restore tool that handles secrets and system state.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
This skill is explicitly designed to preserve and migrate session state, credentials, tokens, and other persistent agent data across machines. That behavior is expected for backup/restore, but it is still sensitive because compromise of archives or misuse of restore operations can transfer active secrets and long-lived access between environments.
- Content
md --- name: myopenclaw-backup-restore description: "Cross-platform backup and restore for OpenClaw. Works on Windows, macOS, and Linux — backups created on any OS can be restored on any other OS. Use when user wants to create a snapshot, restore from backup, migrate to a new machine, or protect against data loss. Supports dry-run preview, automatic pre-restore snapshots, gateway token preservation, credential permission hardening, and a built-in HTTP server for browser-based management. Only requires Node.js (no bash/rsync/python needed)." metadata: openclaw: requires:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
node scripts/backup-restore.js backup [--output-dir
]text Creates `openclaw-backup_{agent}_{timestamp}.tar.gz` in `~/openclaw-backups/`. Auto-prunes (keeps last 7). On non-Windows: `chmod 600` applied. ### restore
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
node scripts/backup-restore.js backup [--output-dir
]text Creates `openclaw-backup_{agent}_{timestamp}.tar.gz` in `~/openclaw-backups/`. Auto-prunes (keeps last 7). On non-Windows: `chmod 600` applied. ### restore
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **Pre-restore snapshot**: Auto-saves current state before overwriting - **Gateway token preservation**: Keeps new server's token (prevents Control UI mismatch) - **Interactive confirmation**: Must type `yes` - **Credential hardening**: `chmod 700/600` on non-Windows - **Auto-restart**: Starts gateway after restore - **Legacy compatibility**: Handles v1 (bash) and v2 archive structures
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **Pre-restore snapshot**: Auto-saves current state before overwriting - **Gateway token preservation**: Keeps new server's token (prevents Control UI mismatch) - **Interactive confirmation**: Must type `yes` - **Credential hardening**: `chmod 700/600` on non-Windows - **Auto-restart**: Starts gateway after restore - **Legacy compatibility**: Handles v1 (bash) and v2 archive structures
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **Pre-restore snapshot**: Auto-saves current state before overwriting - **Gateway token preservation**: Keeps new server's token (prevents Control UI mismatch) - **Interactive confirmation**: Must type `yes` - **Credential hardening**: `chmod 700/600` on non-Windows - **Auto-restart**: Starts gateway after restore - **Legacy compatibility**: Handles v1 (bash) and v2 archive structures
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md * * SECURITY: * - Archives contain bot tokens, API keys, and session credentials * - Permissions hardened on non-Windows (chmod 600 for archive, 700/600 for credentials) * - Pre-restore snapshot always created before overwriting * - Gateway token preserved by default (prevents Control UI mismatch) * - Interactive confirmation required before destructive restore
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md * * SECURITY: * - Archives contain bot tokens, API keys, and session credentials * - Permissions hardened on non-Windows (chmod 600 for archive, 700/600 for credentials) * - Pre-restore snapshot always created before overwriting * - Gateway token preserved by default (prevents Control UI mismatch) * - Interactive confirmation required before destructive restore
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
js * * SECURITY: * - Archives contain bot tokens, API keys, and session credentials * - Permissions hardened on non-Windows (chmod 600 for archive, 700/600 for credentials) * - Pre-restore snapshot always created before overwriting * - Gateway token preserved by default (prevents Control UI mismatch) * - Interactive confirmation required before destructive restore
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
js * * SECURITY: * - Archives contain bot tokens, API keys, and session credentials * - Permissions hardened on non-Windows (chmod 600 for archive, 700/600 for credentials) * - Pre-restore snapshot always created before overwriting * - Gateway token preserved by default (prevents Control UI mismatch) * - Interactive confirmation required before destructive restore
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script invokes external programs via execSync for version detection, archive creation/extraction, and service control, which expands trust beyond local file operations. Because some command arguments incorporate file paths and restored content later influences execution flow, a crafted archive or attacker-controlled environment can turn restore into code execution or unsafe command behavior.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js // ── Interactive confirmation ───────────────────────────────────────── console.log(''); console.log(c.red('⚠️ WARNING: This will OVERWRITE ~/.openclaw/ with backup data.')); console.log(` Backup: ${path.basename(archive)}`); console.log(` Target: ${OPENCLAW_DIR}`); if (currentToken && !overwriteToken) {