ClawHub
Back to skill

Security audit

Dr Backup Gui

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed disaster-recovery GUI that can run powerful backup, sync, restore, and migration commands, but I found no hidden or malicious behavior.

Install only on a controlled admin workstation or virtual environment. Treat saved profiles and logs as sensitive, restrict permissions on ~/.dr_backup_gui, and always run dry-run/review source, destination, SSH target, and delete settings before using rsync --delete, rclone sync, Velero restore, or Coriolis migration against real systems.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

High
Confidence
95% confidence
Finding
The rsync live sync path can execute with --delete enabled and no pre-execution confirmation, allowing immediate deletion of files on the destination if the user misconfigures source, destination, or include/exclude rules. In a DR/backup tool, this context makes the issue more dangerous because users may run it against production or recovery targets where unintended deletion can cause major data loss.

Static analysis

No suspicious patterns detected.