OC Migrator

• Analyzed: May 11, 2026, 4:45 AM
• Findings: 1
• Version: 1.0.0
• Hash: 605efd92c40517504e600f9c3c6f3ffe9e2acf59695b7b57b047e6bb58e1f41b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/migrate.sh` file contains a significant path traversal vulnerability during the restore operation. When extracting and copying files from a backup archive, the script uses `cp -R` on directories within the extracted archive (e.g., `cp -R "$RESTORE_DIR/workspace/$dir/"* "$OC_WORKSPACE/$dir/"`). If a malicious backup file is crafted to contain paths with `../` components (e.g., `openclaw-export-malicious/workspace/memory/../../../../etc/passwd`), the `cp -R` command could overwrite arbitrary files outside the intended OpenClaw directories, leading to potential system compromise. While the skill's stated purpose is legitimate, this critical vulnerability makes it suspicious.