T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup.py:56- Finding
Credential-bearing configuration is archived and uploaded without encryption
- Content
View full analysis
- Remediation
View remediation
Security audit
WebDAV 备份工具
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a genuine WebDAV backup skill, but its defaults can upload unencrypted OpenClaw workspace/configuration data including stored credentials, and it has local restore/write safety gaps that users should review before installing.
Install only if you are comfortable with a backup tool reading your OpenClaw workspace and configuration and sending archives to your configured WebDAV server. Before use, prefer a dedicated least-privilege WebDAV account, HTTPS-only endpoints, encrypted archives, a local backup directory with private permissions, and avoid including live credential files unless you intentionally accept that exposure. Treat restores and --force as filesystem-changing operations and test them in a separate directory first.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.py:258- Finding
User-controlled backup names permit writes outside the selected output directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents and requires sensitive capabilities (environment secrets, file access, and network/WebDAV upload) but does not declare an explicit tool scope such as permissions or allowed-tools. That creates a policy gap: an agent may use broader-than-intended capabilities to read local data and transmit it remotely, which is especially sensitive here because the skill is explicitly designed to back up workspace contents and configuration files to a remote server.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation shows a curl command that places credentials directly on the command line (
curl -u $WEBDAV_USERNAME:$WEBDAV_PASSWORD ...) without warning that command-line arguments may be exposed via shell history, process listings, debugging logs, or monitoring tools. In a backup/configuration guide, users are likely to copy-paste this verbatim, which increases the chance of credential disclosure for the WebDAV service.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
每日自动备份
bash # 添加到 crontab crontab -e # 添加行（根据实际路径调整）： 0 2 * * * /usr/bin/python3 ~/.openclaw/workspace/skills/openclaw-webdav-backup/scripts/backup.py >> /tmp/webdav-backup.log 2>&1
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script restores arbitrary tar.gz archives into a user-chosen directory and does not validate that extracted member paths remain within the intended destination. Although tar.extract(..., filter='data') blocks some dangerous metadata, it does not by itself guarantee protection against path traversal or all overwrite scenarios across Python/runtime variations. In a backup skill context, restore is a high-risk write operation because users are likely to trust backup archives and run it against important directories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The restore path is created if needed and archive members are extracted into it, which modifies the local filesystem and may overwrite files when --force is used. The script prints progress messages, but it does not provide a clear warning in help text or comments that restore is a filesystem-changing operation with overwrite risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script automatically deletes older local backups and remote WebDAV backups as part of normal execution. Although deletion is logged when it occurs, the command-line interface does not clearly warn users beforehand that running a backup may trigger retention-based deletion of existing backups.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest states the tool 'automatically retains the most recent 7 local backups and 20 remote backups,' which suggests a simple count-based retention policy. The implementation instead keeps remote backups newer than 60 days and also preserves at least 20 by count, so remote retention behavior is broader and semantically different from the stated description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script uploads a generated backup archive to a remote WebDAV server, and the default backup set includes the workspace plus configuration files. While there is logging that an upload is happening, there is no user-facing warning that potentially sensitive local data will be transmitted off-host to a remote service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing natural language only in Chinese across the substantive changelog entries. Under the policy rule for language or locale violations, forcing a specific language without user opt-in or a documented justification is a reportable issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The file presents all operational guidance in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Docstrings, status messages, errors, and CLI help are consistently presented in Chinese, which imposes a specific language on all users. There is no indication that the tool is region-specific or that users can opt into another language, so this appears to violate the language/locale policy.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The docstring for cleanup_old_backups states '保留3个月内或者最近20个备份' (keep backups within 3 months or latest 20), but the actual cutoff is RETENTION_DAYS = 60, i.e. about 2 months. This is an active contradiction between inline documentation and implemented retention behavior.
- Content