T06 · System Persistence
Error
- Location
SKILL.md:67- Finding
Recurring Cron Persistence Overwrites the Existing User Crontab
- Content
View full analysis
- Remediation
View remediation
Security audit
Personality Backup
Security checks for vulnerabilities and agentic risk
Overview
This backup skill appears purpose-aligned, but it handles highly sensitive agent data with unsafe defaults, email delivery, and risky scheduling guidance.
Review carefully before installing. Use local-only delivery unless email is truly required, disable secrets and memory backup by default, avoid the provided crontab command, and do not run it with broad workspace paths until temporary-file handling, password handling, and confirmation safeguards are improved.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup.sh:20- Finding
Sensitive Backup Data Uses Predictable Shared Temporary Paths
- Content
View full analysis
/dev/null || true fi ``` ### Technical Analysis The script stages plaintext personality data, memory, configuration, projects, scripts, and secrets beneath `/tmp` before encryption. It constructs paths from the process ID and current date rather than using an atomic secure temporary-file facility. The implementation has the following weaknesses: - `/tmp/agent-backup-$$` is predictable to local processes that can observe or anticipate the backup process. - `/tmp/backup-YYYY-MM-DD.7z` is predictable and shared by every run on the same day. - Concurrent runs use the same archive path and can corrupt, overwrite, or deliver the wrong archive. - The script does not set a restrictive `umask` before creating directories, copied data, or the encrypted archive. - Resulting accessibility depends partly on inherited source permissions and the user's current `umask`, rather than an enforced private backup policy. - Predictable pre-existing filesystem objects can cause denial of service or potentially redirect archive operations, depending on 7z's handling of the object. - The staging area contains plaintext data until the exit trap runs. Abrupt termination that bypasses normal trap processing can leave sensitive material behind. - The cleanup trap is constr ...[truncated 1331 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup.sh:86- Finding
Archive Encryption Password Is Exposed Through Process Arguments
- Content
View full analysis
/dev/null SIZE=$(du -sh "$ARCHIVE_PATH" | cut -f1) ``` The password originates from the configured password file: ```python if pw_file and os.path.isfile(pw_file): with open(pw_file) as f: field = c.get("password_field", "Password") if field: for line in f: if line.startswith(f"{field}:"): password = line.split(":", 1)[1].strip() break ``` ### Technical Analysis The password is passed to 7z as part of the `-p` command-line argument. Command-line arguments can be visible to process-monitoring tools and, depending on operating-system process visibility settings, other local users. Monitoring agents, diagnostic tooling, shell wrappers, audit systems, and privileged processes may also record the complete invocation. Header encryption (`-mhe=on`) protects archive metadata but does not mitigate disclosure of the encryption key itself. Once the password is captured, any locally stored or emailed archive protected by that password can be decrypted. The script also does not verify that `CFG_PASSWORD` is non-empty before copying sensitive files and invoking 7z. A missing file, unmatched field, or empty password therefore does not trigger a deliberate fail-closed validation step. ### Attack Path 1. The user or cron task starts the backup script. 2. `parse_config.py` reads the archive password and emits it into the shell variable `CFG_PASSWORD`. 3. The shell starts 7z with the password embedded in its argument list. 4. A local observer, monitoring system, or privileged process captures the 7z command line while it is running. 5. The ...[truncated 618 chars]- Remediation
View remediation
&2 exit 1 fi ``` - Enforce restrictive permissions on the password file and verify that it is a regular file owned by the expected user. - Avoid exporting the password into child-process environments unnecessarily. - Do not log commands containing credentials, and review process-monitoring or auditing systems for accidental argument capture. - Support key rotation and document re-encryption of retained archives after suspected password exposure. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents this skill as a backup creation and management tool with encryption and delivery features. The supplied code does not back up, copy, compress, encrypt, transmit, or schedule anything. It only loads configuration values and writes a RESTORE.md file containing human-readable restoration instructions. While the generated document references backups and cron re-enablement, those are just text output, not implemented behavior. This is a materially different primary purpose from the declared backup/encryption/delivery functionality.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description advertises backup of secrets, identity files, and memory with email delivery, but it does not prominently warn that highly sensitive data may be archived and transmitted off-host. Users may invoke it without understanding the sensitivity or the exfiltration implications, increasing the risk of unintended disclosure.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill is explicitly designed to access a password file and optionally bundle the secrets directory into backups. In context, this is credential handling rather than accidental mention, but it is still dangerous because it centralizes and processes authentication material alongside a workflow that can email archives off-host.
- Content
json { "password_file": "/home/jan/.openclaw/secrets/backup-password.txt", "password_field": "Password", "delivery": "email", "email": {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes operations that require access to environment variables and writing files, but it declares no explicit tool scope or permission boundaries. In a backup skill that handles secrets, missing capability scoping increases the chance of overbroad execution or silent access to sensitive data without clear user understanding.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill promotes automated backup of personality, memory, config, and workspace data, which creates durable copies of agent state and identity information. This persistence expands the attack surface by preserving sensitive context longer than necessary and making it easier to restore, clone, or inspect the agent's prior state.
- Content
md --- name: personality-backup description: Create encrypted backups of agent personality files, memory, config, secrets, and projects. Use when the agent needs to set up, run, or manage automated backups of its workspace and identity files. Supports configurable backup targets, AES-256 encryption via 7-zip, and delivery via email (SMTP) or local storage. --- # Personality Backup
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation text is broad enough that the skill could be triggered in many contexts involving workspace or identity management, even when backup of secrets was not specifically requested. Because the skill targets memory, config, secrets, and projects, accidental activation could lead to unnecessary collection, archival, or transmission of highly sensitive data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron example sets up unattended recurring backups of sensitive data without warning about persistence, rotation, destination trust, or repeated transmission of secrets. Automating this process can normalize continuous collection and delivery of confidential material, magnifying damage from misconfiguration or account compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script explicitly collects highly sensitive material including secrets, memory, config, and projects, packages it, and can deliver it via email or local storage. Even though encryption is used, there is no explicit consent, interactive warning, destination validation, or minimization control at the point of execution, so a misconfigured or socially engineered run can silently exfiltrate an agent's identity and credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This script automatically emails a backup archive containing highly sensitive material described by the skill as personality files, memory, config, secrets, and projects, yet it provides no user-facing warning, confirmation, or explicit disclosure at the point of transmission. In this skill context, silent exfiltration via SMTP is especially dangerous because the archive leaves the local trust boundary and may be sent to a misconfigured, attacker-controlled, or unintended recipient without the operator realizing it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script reads backup and SMTP credentials from files or environment variables and then prints them as shell variable assignments, exposing secrets to any caller, wrapper script, logs, process captures, or debugging output that consumes stdout. In the context of a backup skill that explicitly handles personality data, memory, config, and secrets, propagating credentials through plaintext shell output materially increases the chance of credential leakage and downstream compromise of backup stores or email infrastructure.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code performs a file write to a user-supplied output path, which can overwrite existing content, but it provides no confirmation prompt, warning comment, or user-facing disclosure beyond a generic success message. For code files, file writes should have some visible disclosure unless the action is clearly explained as part of the skill behavior.
- Content