ClawHub
Back to skill

Security audit

Dr Backup Gui

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed disaster-recovery GUI, but it needs Review because it can perform high-impact infrastructure actions and has avoidable command, install, and local metadata protection risks.

Install only if you understand and trust the infrastructure contexts it will use. Run it as a normal user, review the active Kubernetes context and rclone/rsync/Coriolis targets before actions, avoid unreviewed curl-to-kubectl commands, prefer a virtual environment with pinned dependencies, and restrict ~/.dr_backup_gui permissions because it stores operational metadata in plaintext.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
scripts/check_and_launch.py:82
Finding

Unpinned Dependency Installation and Mutable Kubernetes Manifest Recommendation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dr_backup_gui.py:39
Finding

Sensitive Profiles and Operational Logs Lack Explicit Owner-Only Permissions

Content
View full analysis
dict: return { "archive": self.opt_archive.isChecked(), "compress": self.opt_compress.isChecked(), "verbose": self.opt_verbose.isChecked(), "progress": self.opt_progress.isChecked(), ...[truncated 2631 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dr_backup_gui.py:240
Finding

Unsanitized SSH Identity Path Is Embedded in Rsync Remote-Shell Command

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
## 工具详情

### Velero（需 kubeconfig）

备份：指定命名空间、K8s 资源类型，TTL 保留策略  
恢复：支持命名空间映射（旧集群 → 新集群）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 1470)May include surrounding context.

python
## 工具详情

### Velero（需 kubeconfig）

备份：指定命名空间、K8s 资源类型，TTL 保留策略  
恢复：支持命名空间映射（旧集群 → 新集群）

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 66)May include surrounding context.

python
"""Run a command asynchronously, call on_done(str_output) when done."""
    def worker():
        try:
            env = env or os.environ.copy()
            p = subprocess.run(
                cmd, capture_output=True, text=True, cwd=cwd, env=env,
                timeout=3600,

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs users to run local Python scripts and describes capabilities that inherently require shell execution and file access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent or reviewer cannot easily constrain what the skill is permitted to access, increasing the risk of unintended command execution, file modification, or environment data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code embeds user-facing tool descriptions and status messages in Chinese, and all runtime output is presented in Chinese without offering a language selection or documenting that the skill is region-specific. That is a natural-language policy concern because it enforces a specific locale for users regardless of preference.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_and_launch.py (reported line 41)May include surrounding context.

python
def check_py_pkg(name: str) -> bool:
    try:
        __import__(name.lower().replace("-", "_"))
        return True
    except ImportError:
        return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_and_launch.py (reported line 48)May include surrounding context.

python
def check_tool(name: str, cmd: list) -> bool:
    try:
        r = subprocess.run(cmd, capture_output=True, timeout=10)
        return r.returncode == 0
    except Exception:
        return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_and_launch.py (reported line 86)May include surrounding context.

python
def install_deps():
    print("正在安装 Python 依赖...")
    subprocess.run([sys.executable, "-m", "pip", "install", "PyQt6", "--quiet"])
    print("✅ PyQt6 已安装")
    print()
    print("=" * 55)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 67)May include surrounding context.

python
def worker():
        try:
            env = env or os.environ.copy()
            p = subprocess.run(
                cmd, capture_output=True, text=True, cwd=cwd, env=env,
                timeout=3600,
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 104)May include surrounding context.

python
def discover_clusters(self):
        try:
            result = subprocess.run(
                ["kubectl", "config", "get-contexts", "-o", "name"],
                capture_output=True, text=True,
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 172)May include surrounding context.

python
def list_remotes(self):
        try:
            result = subprocess.run(
                ["rclone", "listremotes"], capture_output=True, text=True,
            )
            if result.returncode == 0:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The application persistently stores profiles, jobs, and config data as plaintext JSON under the user's home directory without a general warning or any file-permission hardening. In a DR/backup tool, those records can contain infrastructure identifiers, remote endpoints, namespace mappings, paths, and SSH-related settings that materially aid lateral movement or environment reconnaissance if local access is obtained.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Across the application, user-facing strings, confirmations, and status text are presented in Chinese only. This imposes a locale/language choice on all users without opt-in or a documented region-specific justification, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 1602)May include surrounding context.

python
def _open_config_dir(self):
        import platform
        if platform.system() == "Darwin":
            subprocess.run(["open", CONFIG_DIR])
        elif platform.system() == "Linux":
            subprocess.run(["xdg-open", CONFIG_DIR])
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 1604)May include surrounding context.

python
if platform.system() == "Darwin":
            subprocess.run(["open", CONFIG_DIR])
        elif platform.system() == "Linux":
            subprocess.run(["xdg-open", CONFIG_DIR])
        else:
            subprocess.run(["explorer", CONFIG_DIR])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dr_backup_gui.py (reported line 1606)May include surrounding context.

python
elif platform.system() == "Linux":
            subprocess.run(["xdg-open", CONFIG_DIR])
        else:
            subprocess.run(["explorer", CONFIG_DIR])

    def _show_about(self):
        QMessageBox.about(self, "关于 DR Backup GUI",

Static analysis

No suspicious patterns detected.