Workspace Git Backup

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This is a legitimate backup skill, but it should be reviewed because it installs ongoing automation that can commit and push all non-ignored files from a chosen directory to a remote Git host.

Install only if you are comfortable with the chosen folder being repeatedly committed and pushed to the configured Git remote. Before enabling the schedule, verify git remote -v, repository privacy, authenticated account, .gitignore rules, and that secrets or personal files are excluded; run a manual backup first and inspect the commit.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to configure automatic `git push` backups to a remote repository but does not clearly warn that workspace contents will be transmitted off-device on an ongoing basis. This can lead to accidental exfiltration of sensitive files, credentials, private notes, or proprietary code if users do not fully understand the scope of what will be synced.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill installs persistent scheduled execution via launchd or cron without an explicit warning that it creates ongoing automation on the user's system. Persistent tasks increase risk because they continue running after the initial interaction, can repeatedly transmit data, and may be forgotten by the user.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script automatically stages all changes, creates a commit, and pushes to the configured remote without any runtime confirmation, dry-run mode, path scoping, or visibility warning to the user. In a backup skill this may be intended behavior, but it is still dangerous because it can silently exfiltrate sensitive files, commit unintended changes, or modify README content before upload when run on a schedule.

Session Persistence

Medium

• Category: Rogue Agent

Content

**New repo:**
```bash
gh repo create <name> --private --source=<backup-path> --remote=origin
```

**Existing repo:**

• Confidence: 90% confidence
• Finding: This finding reflects creation of durable state and persistence through repository configuration and later scheduled backups. In context, the risk is not the `gh repo create` command alone but that it helps establish long-lived data export behavior that may continue beyond the user's immediate awareness, especially when combined with automated push scheduling.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. "新建仓库还是用已有的？" → "新建"
3. "仓库名称？" → "openclaw-backup"
4. "公开还是私有？" → "私有"
5. 执行: gh repo create openclaw-backup --private --source=~/.openclaw/workspace --remote=origin
6. 创建配置文件
7. 安装定时任务
8. "安装完成，每天 12:00 和 00:00 自动备份"

• Confidence: 88% confidence
• Finding: The example dialogue normalizes creating a private remote repository and enabling scheduled backup of the workspace, which reinforces persistent off-device storage of user data. While presented as a legitimate feature, it is security-relevant because users may copy the flow without appreciating that sensitive workspace contents will be continuously committed and pushed.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Backup script | `~/.openclaw/scripts/github-backup.sh` |
| Config | `~/.openclaw/workspace/.backup-config.json` |
| Log | `~/.openclaw/logs/github-backup.log` |
| launchd plist | `~/Library/LaunchAgents/com.openclaw.github-backup.plist` |
| cron entry | Via crontab |

## Example Dialog

• Confidence: 93% confidence
• Finding: This duplicate finding points to the same persistence artifacts listed in the file table, especially the `launchd` plist and cron entry. The danger comes from durable automation affecting user data after setup, not from the documentation itself, so the security issue is the undisclosed persistence semantics of the skill's behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Backup script | `~/.openclaw/scripts/github-backup.sh` |
| Config | `~/.openclaw/workspace/.backup-config.json` |
| Log | `~/.openclaw/logs/github-backup.log` |
| launchd plist | `~/Library/LaunchAgents/com.openclaw.github-backup.plist` |
| cron entry | Via crontab |

## Example Dialog

• Confidence: 93% confidence
• Finding: This duplicate finding points to the same persistence artifacts listed in the file table, especially the `launchd` plist and cron entry. The danger comes from durable automation affecting user data after setup, not from the documentation itself, so the security issue is the undisclosed persistence semantics of the skill's behavior.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.