帮助其他OpenClaw实例通过GitHub仓库实现记忆同步

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:17 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs Review because it can broadly sync local workspace data to GitHub while handling a GitHub token and destructive file operations with weak safeguards.

Install only if you are comfortable reviewing generated shell scripts and syncing a narrowly scoped private GitHub repository. Use a disposable least-privilege token, avoid syncing folders that may contain secrets, and do not enable scheduled sync until upload, merge, and deletion behavior are clear.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill executes shell commands via child_process.exec and also generates executable bash scripts that later perform git, rsync, cp, find, and rm operations. This creates a large command-execution and filesystem-modification surface, and because parts of the commands are built from user-controlled or derived values such as repoUrl and paths, the capability is materially more dangerous than ordinary sync logic.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to enter a GitHub personal access token but provides no warning about its sensitivity, storage risks, or scope minimization. In a skill that automates script and configuration creation for cross-device sync, this omission increases the chance that users expose long-lived credentials in plaintext files, shell history, logs, or repository content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill writes executable scripts and configuration files into the workspace without a clear prior warning or consent flow for local file modifications. In this context, silently dropping runnable scripts increases the chance of users later executing unsafe operations they did not fully review.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The generated upload script includes destructive cleanup behavior using find ... -exec rm -rf and performs repository mutations, but the skill does not warn the user beforehand. Because the script is created for later execution and operates on broad directory trees, accidental data loss is plausible even without malicious intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script copies local workspace contents to a remote GitHub repository without an explicit privacy notice, data classification, or consent for transmission. Since the workspace may contain notes, secrets, credentials, or personal memory data, this can cause broad unintended disclosure.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The generated sync logic is designed to copy the entire local workspace into a GitHub repository, which semantically instructs bulk disclosure of user memory/workspace contents. In a cross-device sync skill this capability is contextually related to the feature, but it remains dangerous because no minimization, filtering, or secret handling is implemented.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The upload script operationalizes ongoing publication of local workspace contents to the remote repository. Repeated automatic uploads magnify the privacy and data-exfiltration risk, especially if the workspace later accumulates credentials or other sensitive artifacts.

Credential Access

High

• Category: Privilege Escalation

Content

console.log('开始设置跨设备同步...');
        
        const repoUrl = await prompt('请输入GitHub仓库URL: ');
        const token = await prompt('请输入GitHub Personal Access Token (输入将被隐藏): ');
        
        // 由于安全性考虑，在实际实现中需要更安全的密码输入方式
        console.log('正在设置同步...');

• Confidence: 92% confidence
• Finding: Access Token

Credential Access

High

• Category: Privilege Escalation

Content

},
          "token": {
            "type": "string",
            "description": "GitHub Personal Access Token"
          }
        },
        "required": ["repoUrl", "token"]

• Confidence: 98% confidence
• Finding: Access Token

Credential Access

High

• Category: Privilege Escalation

Content

// 获取用户输入
    const repoUrl = await this.promptUser('请输入GitHub仓库URL: ');
    const token = await this.promptUser('请输入GitHub Personal Access Token: ', true);
    
    // 验证仓库访问
    if (!(await this.validateRepoAccess(repoUrl, token))) {

• Confidence: 93% confidence
• Finding: Access Token

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"backup"
  ],
  "dependencies": {
    "fs-extra": "^11.0.0"
  }
}

• Confidence: 87% confidence
• Finding: "fs-extra": "^11.0.0"

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:57