ClawHub
Back to skill

Security audit

Openclaw Backup Optimized

Security checks for vulnerabilities and agentic risk

Overview

This is a real backup skill, but it can repeatedly copy and push highly sensitive OpenClaw state and workspace data without enough safeguards or warnings.

Install only if you intentionally want full-state OpenClaw backups. Use a private dedicated repository, narrow credentials, encryption before pushing, reviewed exclusions for secrets and workspace data, and a manually approved cron schedule; avoid Discord notifications if changed paths or restore text could reveal sensitive information.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/backup.js:207
Finding

Unencrypted Full-State Backup Can Expose Credentials, Configuration, and Workspace Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- Script: `scripts/backup.js` (cross-platform)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- Script: `scripts/backup.js` (cross-platform)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
- Script: `scripts/backup.js` (cross-platform)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs users to read environment variables and configure backup-related secrets/paths, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, missing scope makes the skill's capabilities less transparent and can enable unintended access to local state or secrets during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description uses broad trigger language like backup automation, snapshot/restore, and GitHub backup repos, which can cause the skill to activate in contexts the user did not intend. Because the skill performs filesystem backup and scheduling actions, accidental invocation can expose sensitive data or create persistent jobs without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises full snapshots of ~/.openclaw and Discord notifications but does not warn that backups may contain sensitive local data, credentials, history, or workspace contents. Omitting this warning is dangerous because users may transmit summaries or store archives in external repositories/services without understanding the confidentiality risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill explicitly instructs creation of a recurring cron job in the gateway environment, establishing persistence. Persistent scheduled execution increases risk because a misconfigured or later-modified backup script can repeatedly access and exfiltrate local state or continue operating after the original user session ends.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

node ~/.openclaw/workspace/tools/openclaw-backup.js

text

4) Create cron (OpenClaw cron runs in the gateway environment):
```bash
openclaw cron add --name "openclaw-backup-daily" \
  --cron "0 5,10,15,20 * * *" --tz "America/Sao_Paulo" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The configuration explicitly supports pushing backups to a remote Git repository and sending Discord notifications, which can transmit backup-related data off-host. In a backup skill, this is contextually plausible, but the file provides no warning, consent guidance, or data-minimization note, increasing the risk that users exfiltrate sensitive workspace contents or metadata without realizing it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file specifies America/Sao_Paulo as the default timezone, which imposes a locale-specific default in natural-language configuration guidance. No opt-in, alternative selection guidance, or region-specific justification is provided.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/package.json (reported line 8)May include surrounding context.

json
"version": "1.0.0",
  "description": "Cross-platform OpenClaw backup script",
  "dependencies": {
    "minimatch": "^9.0.5",
    "tar": "^6.2.1"
  }
}

Unverifiable Dependency: minimatch has 5 known advisory(ies) (CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/package.json (reported line 9)May include surrounding context.

json
"description": "Cross-platform OpenClaw backup script",
  "dependencies": {
    "minimatch": "^9.0.5",
    "tar": "^6.2.1"
  }
}

Unverifiable Dependency: tar has 16 known advisory(ies) (CVE-2026-59873 (node-tar: Decompression/parse DoS via unlimited input); CVE-2025-64118 (node-tar has a race condition leading to uninitialized memory exposure); CVE-2026-24842 (node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Trave) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/backup.js:65