帮助其他OpenClaw实例通过GitHub仓库实现记忆同步

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:17 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs Review because it can broadly sync local workspace data to GitHub while handling a GitHub token and destructive file operations with weak safeguards.

Install only if you are comfortable reviewing generated shell scripts and syncing a narrowly scoped private GitHub repository. Use a disposable least-privilege token, avoid syncing folders that may contain secrets, and do not enable scheduled sync until upload, merge, and deletion behavior are clear.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill executes shell commands via child_process.exec and also generates executable bash scripts that later perform git, rsync, cp, find, and rm operations. This creates a large command-execution and filesystem-modification surface, and because parts of the commands are built from user-controlled or derived values such as repoUrl and paths, the capability is materially more dangerous than ordinary sync logic.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to enter a GitHub personal access token but provides no warning about its sensitivity, storage risks, or scope minimization. In a skill that automates script and configuration creation for cross-device sync, this omission increases the chance that users expose long-lived credentials in plaintext files, shell history, logs, or repository content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill writes executable scripts and configuration files into the workspace without a clear prior warning or consent flow for local file modifications. In this context, silently dropping runnable scripts increases the chance of users later executing unsafe operations they did not fully review.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The generated upload script includes destructive cleanup behavior using find ... -exec rm -rf and performs repository mutations, but the skill does not warn the user beforehand. Because the script is created for later execution and operates on broad directory trees, accidental data loss is plausible even without malicious intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script copies local workspace contents to a remote GitHub repository without an explicit privacy notice, data classification, or consent for transmission. Since the workspace may contain notes, secrets, credentials, or personal memory data, this can cause broad unintended disclosure.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The generated sync logic is designed to copy the entire local workspace into a GitHub repository, which semantically instructs bulk disclosure of user memory/workspace contents. In a cross-device sync skill this capability is contextually related to the feature, but it remains dangerous because no minimization, filtering, or secret handling is implemented.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The upload script operationalizes ongoing publication of local workspace contents to the remote repository. Repeated automatic uploads magnify the privacy and data-exfiltration risk, especially if the workspace later accumulates credentials or other sensitive artifacts.

Credential Access

High

• Category: Privilege Escalation

Content

console.log('开始设置跨设备同步...');
        
        const repoUrl = await prompt('请输入GitHub仓库URL: ');
        const token = await prompt('请输入GitHub Personal Access Token (输入将被隐藏): ');
        
        // 由于安全性考虑，在实际实现中需要更安全的密码输入方式
        console.log('正在设置同步...');

• Confidence: 92% confidence
• Finding: The CLI requests a GitHub Personal Access Token using a normal readline prompt, but standard readline input is not hidden, despite the prompt claiming it will be. This can expose the token on-screen, in terminal recordings, shoulder-surfing scenarios, or shell/session logs, leading to credential compromise and unauthorized repository access.

Credential Access

High

• Category: Privilege Escalation

Content

},
          "token": {
            "type": "string",
            "description": "GitHub Personal Access Token"
          }
        },
        "required": ["repoUrl", "token"]

• Confidence: 98% confidence
• Finding: The skill explicitly requires a GitHub Personal Access Token as a direct input parameter, creating a credential-collection surface inside the skill interface. This is dangerous because PATs can grant broad repository or account access, and the config provides no indication of scoped permissions, secure storage, redaction, or safer OAuth-style alternatives.

Credential Access

High

• Category: Privilege Escalation

Content

// 获取用户输入
    const repoUrl = await this.promptUser('请输入GitHub仓库URL: ');
    const token = await this.promptUser('请输入GitHub Personal Access Token: ', true);
    
    // 验证仓库访问
    if (!(await this.validateRepoAccess(repoUrl, token))) {

• Confidence: 93% confidence
• Finding: The skill requests a GitHub Personal Access Token and then interpolates it into a git clone URL for execution, which risks exposing the credential through process listings, shell history, logs, error messages, or repository configuration. The subsequent command construction also increases the blast radius if input is malformed or abused.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"backup"
  ],
  "dependencies": {
    "fs-extra": "^11.0.0"
  }
}

• Confidence: 87% confidence
• Finding: Using a caret range for dependencies allows newer compatible versions to be installed automatically, which can introduce supply-chain risk if a future release is compromised or contains a breaking security issue. In this package context, the risk is somewhat limited because only a single common utility dependency is declared, but it still reduces build reproducibility and trustworthiness.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:57