T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/config.sh:8- Finding
OpenClaw Data Is Pushed to a Hardcoded Third-Party Git Organization
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw-gitbak
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its backup/restore purpose, but its defaults can upload OpenClaw data to a hardcoded third-party Git organization and can delete local files during restore without adequate warning.
Review this skill carefully before installing. Configure your own Git destination before any backup, inspect exactly what files would be committed, and avoid running restore against existing directories unless you have an independent backup because the script can remove local files first.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/restore.sh:64- Finding
Restore Operation Deletes Local Files Before Recovery Is Validated
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The restore logic deletes all non-.git files in an existing target directory before adding the remote and pulling, with no confirmation, dry-run, backup, or validation that the directory is actually the intended repository. If the configured path is wrong, reused, or contains valuable local data, running restore can irreversibly destroy user files and replace them with repository contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation exposes restore commands that can plausibly replace local configuration or workspace contents, but it does not warn users about overwrite or data-loss behavior. In a backup/restore skill, omission of destructive-operation warnings increases the chance of accidental self-inflicted data loss, especially when users run broad targets like 'all'.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's comments, usage text, and runtime messages are presented in Chinese only, which imposes a specific language on users. The file does not provide any opt-in, alternative locale, or justification that the skill is intended only for a Chinese-speaking or region-specific environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This shell file contains natural-language comments and descriptive strings exclusively in Chinese, including configuration guidance and backup item descriptions. Under the stated policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script's usage text and operational messages are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative locale handling. This matches the policy category for language or locale constraints expressed in natural-language strings.
- Content