Openclaw Github Sync

• Outcome: Review
• Latest audit: May 28, 2026, 8:30 AM
• Version:
  0.1.4

Overview

This skill is transparent about syncing agent context, but its default setup can upload broad memory, persona, and skill files to a private Git repo and can manually overwrite agent behavior from that repo.

Install only if you are comfortable syncing agent context to a private Git repo. Before enabling nightly sync, narrow references/export-manifest.txt to reviewed non-sensitive files, prefer memory/public over raw memory, use least-privilege GitHub credentials or a deploy key, inspect the first exported repo, and treat pull as high-risk: run a dry run, review changes, and never automate it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script unconditionally sources `references/.env` as shell code when any managed variable is unset. Because `source` executes arbitrary Bash syntax rather than parsing simple key/value pairs, anyone who can modify that file can run commands in the context of the sync workflow, which is especially risky in a tool that interacts with Git-managed workspace content.

VirusTotal

64/64 vendors flagged this skill as clean.