ClawHub
Back to skill

Security audit

TimeMachine

Security checks for vulnerabilities and agentic risk

Overview

This backup skill fits its stated purpose, but it needs review because it copies secrets and workspace data into persistent snapshots without implementing the encryption it claims.

Install only if you are comfortable with this skill storing copies of your OpenClaw credentials, .env, configuration, skills, and workspace files under ~/.openclaw/snapshots. Treat those snapshots as sensitive secret material, restrict local access, avoid syncing or sharing them, and be cautious restoring snapshots from any location another process or person could modify.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/snapshot.py:119
Finding

Sensitive configuration and secret files are copied without backup encryption

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/restore.py:68
Finding

Unauthenticated snapshot contents can overwrite active OpenClaw state during restoration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cleanup.py:35
Finding

Retention cleanup can delete full snapshots required by incremental snapshots

Content
View full analysis
MAX_COUNT: excess = total - MAX_COUNT print(f" 📉 Deleting {excess} excess snapshots (max: {MAX_COUNT})") for snap, _ in snapshots[:excess]: print(f" 🗑️ Deleting: {snap}") if not dry_run: import shutil shutil.rmtree(os.path.join(SNAPSHOT_DIR, snap)) ``` ### Technical Analysis Incremental snapshots identify a full snapshot as their restoration base. Cleanup does not inspect this dependency before deleting snapshots. It deletes entries solely according to directory modification time and numeric version order. Consequently, an older full snapshot can be deleted while a newer incremental snapshot that references it remains. The remaining incremental snapshot is then incomplete and cannot reliably reconstruct the advertised recovery point. The count-based pass also operates on the original `snapshots` list after the age-based pass has removed directories. A snapshot selected in both passes can be passed to `shutil.rmtree` twice, causing `FileNotFoundError` and terminating cleanup. The script also does not repair `index.json` after deleting the latest or base snapshots. ### Attack Path This issue can be triggered through normal operation without an attacker: 1. A full snapshot is created. 2. One or more incremental snapshots are created with that full snapshot as their `base_version`. 3. The ...[truncated 1051 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Including .env in the backup target list causes the snapshot process to collect secret-bearing environment files, which commonly contain API keys, tokens, database credentials, and other sensitive material. Because the script persists these secrets into snapshot storage alongside other copied data, compromise of the snapshot directory or later reuse of snapshots can directly expose credentials.

Content

Scanner excerpt · scripts/snapshot.py (reported line 34)May include surrounding context.

python
"channels",
    "skills",
    "credentials",
    ".env"
]

# Workspace files (the entire workspace directory)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly backs up highly sensitive material including 'credentials/*' and '.env', but the description does not prominently warn users about the sensitivity, storage implications, or access controls for those backups. Backups concentrate secrets into restorable artifacts, so if snapshots are viewed, copied, or stored insecurely, credentials and environment secrets may be exposed or reused by an attacker.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger phrases are generic backup-related language such as 'create backup' and 'delete snapshot', which can overlap with ordinary user requests and cause the skill to activate unexpectedly. In a skill that can create, restore, or delete snapshots of configuration and memory, unintended invocation can lead to unauthorized state changes, accidental rollback, or exposure of sensitive backup contents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/snapshot.py (reported line 3)May include surrounding context.

python
#!/usr/bin/env python3
"""
Way Back - Create Snapshot
Usage: python snapshot.py [--full]
"""
import os

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script is designed to back up sensitive configuration material, including credentials and environment files, into snapshot storage without any warning, consent step, masking, or access-control considerations. In an agent skill context, silently aggregating secrets and workspace contents into a centralized snapshot directory increases the chance of accidental disclosure, later exfiltration, or overly broad retention of confidential data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code comment at L188 says 'Incremental - store changed files', but the loops at L195-L213 unconditionally copy every existing target and workspace item without comparing hashes or changes. This also conflicts with the metadata field 'patch_count' and the implied intent of an incremental snapshot, because the implementation behaves like a full copy of selected content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The retention settings describe automatic deletion of backups based on age or count, but there is no clear warning that deletion may be irreversible and could remove the only recovery point. In a backup skill, users may overestimate recoverability, and silent cleanup can increase the chance of permanent data loss after a failed change or delayed incident response.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.