OpenClaw Git Backup

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate git backup skill, but it needs Review because it can automatically commit and push broad repository contents on a schedule with weak safeguards around shell templating and credentials.

Install only after confirming the exact repository, remote, branch, schedule, and exclude rules. Treat the first run as a review run: inspect what git add would stage, make sure secrets and local state files are ignored or excluded, and prefer SSH deploy keys, a keychain, or narrowly scoped short-lived credentials over Git's plaintext store. Avoid using the provided bash -lc cron template with unescaped values; use a direct script invocation or safely quoted scheduler configuration.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cron-job-template.md:18

Finding

Shell Command Injection Through Unescaped Cron Template Values

Content

View full analysis

' \ BACKUP_BRANCH='' \ BACKUP_TZ='' \ BACKUP_AUTHOR_NAME='OpenClaw Backup' \ BACKUP_AUTHOR_EMAIL='backup@local' \ BACKUP_EXCLUDES='' \ bash -lc ' ' ``` The agent instruction template reinforces execution of the interpolated command: ```text You are running a scheduled git backup for . Requirements: 1) commit if there are staged changes after exclusions, 2) use the bundled backup script so the commit subject includes +added ~modified -deleted counts and the commit body lists changed files, 3) push to /, 4) still run push even if there was no new commit so older local commits are flushed, 5) do not ask the user questions. First run this exact command, then summarize the result briefly: BACKUP_REMOTE='' BACKUP_BRANCH='' BACKUP_TZ='' BACKUP_AUTHOR_NAME='OpenClaw Backup' BACKUP_AUTHOR_EMAIL='backup@local' BACKUP_EXCLUDES='' bash -lc ' ' ``` Related guidance in `SKILL.md` uses the same unsafe construction: ```bash bash -lc ' ' ``` ### Technical Analysis Values such as the repository path, runtime script path, remote, branch, timezone, and exclusion patterns are inserted into shell source code using fixed single quotes. No validation or shell-safe escaping is prescribed. If any substituted value contains a single quote, it can terminate the intended quoted string. Subsequent characters are then interpreted as shell syntax. The use of `bash -lc` introduces another shell parsing pass, increasing the likelihood that metacharacters embedded in generated command text will be executed rather ...[truncated 1485 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nightly_git_backup.sh:23

Finding

Automatic Commit and Push of Potentially Sensitive Repository Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:87

Finding

GitHub Access Token Stored in a Plaintext Credential File

Content

View full analysis

config credential.helper 'store --file=/.git/credentials' git -C config credential.useHttpPath true printf 'protocol=https\nhost=github.com\npath=OWNER/REPO.git\nusername=x-access-token\npassword=TOKEN\n' | git -C credential approve chmod 600 /.git/credentials git -C ls-remote --heads ``` ### Technical Analysis Git's `store` credential helper persists credentials without encryption. The `chmod 600` instruction appropriately limits access to the owning user, but it does not encrypt the token or protect it from processes running under the same account, account compromise, privileged administrators, endpoint collection tools, or accidental copying of the `.git` directory. The file resides under `.git`, so the backup script's normal `git add` operation does not directly commit it. Nevertheless, it remains a reusable plaintext secret on disk. ### Attack Path 1. A user supplies a GitHub HTTPS token during backup configuration. 2. The documented commands configure Git's plaintext `store` credential helper. 3. `git credential approve` writes the token to `/.git/credentials`. 4. A malicious process, compromised tool, or attacker with access as the same operating-system user reads the file. 5. The attacker extracts and reuses the token against GitHub or the configured repository path. 6. The attacker performs any operation permitted by the token's scopes and repository authorization until the token expires or is revoked. ### Impact Assessment The token can be used with the permissions assigned to it. Depending on its scope, this may permit reading private repository data, pushing malicious commits, modifying branches, or performing other repository operations. This ...[truncated 256 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

This skill includes `scripts/nightly_git_backup.sh`.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/nightly_git_backup.sh (reported line 62)May include surrounding context.

sh

renamed_count=0
status_file=""
body_file=""
trap '[[ -n "$status_file" ]] && rm -f "$status_file"; [[ -n "$body_file" ]] && rm -f "$body_file"' EXIT

if ! git diff --cached --quiet; then
  status_file="$(mktemp)"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

git -C config credential.helper 'store --file=/.git/credentials' git -C config credential.useHttpPath true printf 'protocol=https\nhost=github.com\npath=OWNER/REPO.git\nusername=x-access-token\npassword=TOKEN\n' | git -C credential approve chmod 600 /.git/credentials git -C ls-remote --heads

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The instruction to 'do not ask the user questions' removes an important safety check while authorizing autonomous commit and push behavior. In the context of scheduled backups, this increases the chance that the agent proceeds despite ambiguous configuration, unexpected staged files, credential issues, or a misconfigured remote, leading to unintended data disclosure or repository changes.

Content

Scanner excerpt · references/cron-job-template.md (reported line 35)May include surrounding context.

agentTurn message template

text

You are running a scheduled git backup for <repo-root>. Requirements: 1) commit if there are staged changes after exclusions, 2) use the bundled backup script so the commit subject includes +added ~modified -deleted counts and the commit body lists changed files, 3) push to <remote>/<branch>, 4) still run push even if there was no new commit so older local commits are flushed, 5) do not ask the user questions. First run this exact command, then summarize the result briefly:

BACKUP_REMOTE='<remote>' BACKUP_BRANCH='<branch>' BACKUP_TZ='<timezone>' BACKUP_AUTHOR_NAME='OpenClaw Backup' BACKUP_AUTHOR_EMAIL='backup@local' BACKUP_EXCLUDES='<exclude-patterns>' bash -lc '<runtime-script> <repo-root>'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template instructs an automated workflow to commit local repository changes and push them to a remote without embedding any user-facing warning, confirmation, or explicit acknowledgement of the data-transfer and history-modification effects. In a backup skill, this can cause unintended publication of sensitive files, accidental transmission to the wrong remote or branch, and silent persistence of changes through scheduled execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script automatically stages all changes, creates a commit, and pushes to a remote without any interactive confirmation or policy guardrails. In a backup-oriented skill this may be intentional, but it is still risky because it can exfiltrate unintended files, secrets, or accidental modifications to a remote repository on a scheduled basis.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.