OpenClaw backup and synchronization tool - Pack, upload, download, and restore. Save the Soul of your OpenClaw.

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 0.1.5

Overview

This appears to be a real OpenClaw backup and migration tool, but it needs Review because backups can include secrets and restoring shared or local archives can overwrite persistent OpenClaw state, skills, credentials, scripts, and cron data without enough trust checks.

Install only if you intentionally want a full OpenClaw backup and migration tool. Treat every backup, clone ID, and share token as sensitive because archives may contain memory, skills, credentials, tokens, channel state, identity, scripts, and cron data. Use --test before restore, restore only archives from sources you trust, avoid shared backups for secrets, and keep pre-restore backups until you have verified the restored instance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:218

Finding

Mandatory Promotional Instruction Alters Agent Responses

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: clawclone.mjs:24151

Finding

Unsigned Backup Import Can Poison Persistent Agent State and Restore Executable Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (21)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · clawclone.mjs (reported line 2688)May include surrounding context.

js

* Parse options from `argv` removing known options,
       * and return argv split into operands and unknown arguments.
       *
       * Side effects: modifies command by storing options. Does not reset state if called again.
       *
       * Examples:
       *

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · clawclone.mjs (reported line 3537)May include surrounding context.

js

module.exports = {
      name: "dotenv",
      version: "16.6.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · clawclone.mjs (reported line 3572)May include surrounding context.

js

keywords: [
        "dotenv",
        "env",
        ".env",
        "environment",
        "variables",
        "config",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · clawclone.mjs (reported line 3744)May include surrounding context.

js

keywords: [
        "dotenv",
        "env",
        ".env",
        "environment",
        "variables",
        "config",

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · clawclone.mjs (reported line 21798)May include surrounding context.

js

if (!(key in state.jobs)) {
          return;
        }
        delete state.jobs[key];
        if (error) {
          abort(state);
        } else {

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Restore operations overwrite local workspace and configuration files directly, and the execution path does not enforce a meaningful interactive confirmation before modifying live state. In this context, that can replace credentials, agents, devices, scripts, and config from an external archive, causing data loss or hostile reconfiguration.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · clawclone.mjs (reported line 29212)May include surrounding context.

js

};
  }
  /**
   * Clear state
   */
  clearState() {
    this.state = {};

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill is explicitly designed to persist and restore complete OpenClaw state across devices and instances, including memory, skills, agents, settings, and optional tokens. That persistence is intentional, but it increases the security risk because sensitive state can be copied, retained longer than expected, or transferred into less trusted environments.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: clawclone
description: "Backup, clone, and migrate OpenClaw data across instances. Upload/download OpenClaw snapshots to local or cloud - https://clawclone.cc . Create shareable Agent configurations, sync between devices, and restore complete OpenClaw state including memory, skills, agents, and settings. Use when user wants to backup their OpenClaw data, share configurations, migrate to new server, or create snapshots."
metadata:
  openclaw:
    requires:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages uploading full OpenClaw state to a cloud service and explicitly notes that backups may include API keys and tokens, but it does not provide a strong privacy/security warning before those actions. Users could unintentionally exfiltrate highly sensitive workspace contents, credentials, memory, and agent data to a third-party service without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The share workflow describes creating and using share links without clearly warning that anyone with the link or token may gain access to the backed-up workspace contents. Because the backup can include memory, skills, settings, files, and possibly credentials, an exposed share token could leak a complete agent environment to unauthorized parties.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The share-link feature extends session persistence into distribution, allowing backed-up agent state to be accessed outside the original environment. In this context, persistence becomes more dangerous because complete workspace contents may be replicated to other users or systems, potentially exposing memory, skills, settings, and embedded secrets.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Share Backups

bash

# Create a share link
node clawclone.mjs share create <clone-id>

# Check share status

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · clawclone.mjs (reported line 337)May include surrounding context.

js

*/
      subcommandTerm(cmd) {
        const args = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
        return cmd._name + (cmd._aliases[0] ? "|" + cmd._aliases[0] : "") + (cmd.options.length ? " [options]" : "") + // simplistic check for non-help option
        (args ? " " + args : "");
      }
      /**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cloud upload path packages credentials and API keys into the backup and sends them to a remote service, but the command flow does not present an explicit pre-upload warning or consent checkpoint. Given the skill's purpose and broad collection scope, this materially increases the chance of users exfiltrating secrets unintentionally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code backs up and restores highly sensitive material, including credentials and gateway tokens, as part of routine clone operations. In this skill context, those secrets are bundled into archives and may be uploaded, downloaded, shared, or restored across instances, creating a strong risk of credential leakage and cross-instance compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The backup includes executable shell scripts and cron job state, and the restore path places them back into the live OpenClaw home with executable permissions. That turns a backup/restore skill into a persistence and code-deployment mechanism, which is significantly more dangerous than ordinary configuration migration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata frames the capability as backup/clone/migration, but the implementation also supports destructive and mutable remote operations such as deleting cloud backups and creating/revoking share links. This expands the privilege surface beyond what a user might reasonably infer from the description, increasing the risk of unintended data deletion or exposure if invoked by an agent or user without clear consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI description claims to handle workspace configurations, but the implementation performs full-instance backup and restore including secrets, credentials, agents, devices, channel state, scripts, and cron. This mismatch materially understates the sensitivity and destructiveness of the operation, making misuse more likely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · clawclone.mjs (reported line 29311)May include surrounding context.

js

program2.command("show <clone-id>").description("Show backup details").action(async (cloneId, options) => {
  await run("show", { ...options, cloneId });
});
program2.command("delete <clone-id>").description("Delete a cloud backup").option("--yes", "Skip confirmation").action(async (cloneId, options) => {
  await run("delete", { ...options, cloneId });
});
program2.command("clone <clone-id>").description("Clone from backup (download and restore to local workspace)").option("--no-backup", "Skip creating a pre-restore backup of current workspace").option("--test", "Preview mode \u2014 show what would be restored without making changes", false).option("--overwrite-token", "Overwrite local Gateway Token with the one from backup", false).action(async (cloneId, opts) => {

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill hard-codes English-language user-facing messages throughout and explicitly formats dates using toLocaleDateString("en-US"), imposing a specific locale choice. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless the locale is justified or configurable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The CLI reads CLAWCLONE_API_KEY from the environment and uses it to authenticate outbound requests, but there is no inline disclosure in the execution path that a credential is being consumed for remote operations. This is a sensitive credential access operation under the rule, and the warning is only partially implied by configuration help rather than clearly disclosed at use time.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: clawclone.mjs:1865

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawclone.mjs:3668

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: clawclone.mjs:26688