Security audit

Workspace Git Backup

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate backup skill, but it should be reviewed because it installs ongoing automation that can commit and push all non-ignored files from a chosen directory to a remote Git host.

Install only if you are comfortable with the chosen folder being repeatedly committed and pushed to the configured Git remote. Before enabling the schedule, verify git remote -v, repository privacy, authenticated account, .gitignore rules, and that secrets or personal files are excluded; run a manual backup first and inspect the commit.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs users to configure automatic `git push` backups to a remote repository but does not clearly warn that workspace contents will be transmitted off-device on an ongoing basis. This can lead to accidental exfiltration of sensitive files, credentials, private notes, or proprietary code if users do not fully understand the scope of what will be synced.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill installs persistent scheduled execution via launchd or cron without an explicit warning that it creates ongoing automation on the user's system. Persistent tasks increase risk because they continue running after the initial interaction, can repeatedly transmit data, and may be forgotten by the user.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script automatically stages all changes, creates a commit, and pushes to the configured remote without any runtime confirmation, dry-run mode, path scoping, or visibility warning to the user. In a backup skill this may be intended behavior, but it is still dangerous because it can silently exfiltrate sensitive files, commit unintended changes, or modify README content before upload when run on a schedule.

Session Persistence

Medium

Category: Rogue Agent
Content: **New repo:** ```bash gh repo create <name> --private --source=<backup-path> --remote=origin ``` **Existing repo:**
Confidence: 90% confidence
Finding: create <name> --private --source=<backup-path> --remote=origin ``` **Existing repo:** ```bash # List repos gh repo list --limit 50 # Add remote (user provides repo name or URL) git -C <backup-path>

Session Persistence

Medium

Category: Rogue Agent
Content: 2. "新建仓库还是用已有的？" → "新建" 3. "仓库名称？" → "openclaw-backup" 4. "公开还是私有？" → "私有" 5. 执行: gh repo create openclaw-backup --private --source=~/.openclaw/workspace --remote=origin 6. 创建配置文件 7. 安装定时任务 8. "安装完成，每天 12:00 和 00:00 自动备份"
Confidence: 88% confidence
Finding: create openclaw-backup --private --source=~/.openclaw

Session Persistence

Medium

Category: Rogue Agent
Content: | Backup script | `~/.openclaw/scripts/github-backup.sh` | | Config | `~/.openclaw/workspace/.backup-config.json` | | Log | `~/.openclaw/logs/github-backup.log` | | launchd plist | `~/Library/LaunchAgents/com.openclaw.github-backup.plist` | | cron entry | Via crontab | ## Example Dialog
Confidence: 93% confidence
Finding: plist

Session Persistence

Medium

Category: Rogue Agent
Content: | Backup script | `~/.openclaw/scripts/github-backup.sh` | | Config | `~/.openclaw/workspace/.backup-config.json` | | Log | `~/.openclaw/logs/github-backup.log` | | launchd plist | `~/Library/LaunchAgents/com.openclaw.github-backup.plist` | | cron entry | Via crontab | ## Example Dialog
Confidence: 93% confidence
Finding: plist

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.