OC Migrator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:09 AM UTC
• Version: 1.0.0

Overview

This migration skill does what it says broadly, but its restore and backup handling can overwrite persistent agent state and expose sensitive backups without enough safeguards.

Install only if you are comfortable with a migration script that can copy sensitive OpenClaw config, memory, scripts, and skills into and out of your live environment. Use only backups you created and transferred through trusted channels, avoid --no-encrypt for sensitive data, do not reuse the backup password, and consider manually staging or inspecting an archive before restoring because existing agent state may be overwritten.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: scripts/migrate.sh:185

Finding

Unauthenticated Backup Restoration Can Poison Persistent Agent State

Content

View full analysis

/dev/null | head -1) if [ -z "$RESTORE_DIR" ]; then echo "❌ Invalid backup format" rm -rf "$TMPDIR" exit 1 fi # Show manifest if [ -f "$RESTORE_DIR/manifest.json" ]; then echo " 📋 Backup from: $(cat "$RESTORE_DIR/manifest.json")" fi # Restore config if [ -d "$RESTORE_DIR/config" ]; then echo " → Restoring config" cp "$RESTORE_DIR/config/openclaw.json" "$OC_HOME/openclaw.json" 2>/dev/null && echo " ✅ openclaw.json" chmod 600 "$OC_HOME/openclaw.json" if [ -d "$RESTORE_DIR/config/agents" ]; then cp -R "$RESTORE_DIR/config/agents/"* "$OC_HOME/agents/" 2>/dev/null && echo " ✅ agents/" find "$OC_HOME/agents" -name "*.json" -exec chmod 600 {} \; fi fi # Restore workspace if [ -d "$RESTORE_DIR/workspace" ]; then echo " → Restoring workspace" for f in "$RESTORE_DIR/workspace"/*.md; do [ -f "$f" ] && cp "$f" "$OC_WORKSPACE/" && echo " ✅ $(basename $f)" done for dir in memory knowledge .learnings scripts skills; do if [ -d "$RESTORE_DIR/workspace/$dir" ]; then mkdir -p "$OC_WORKSPACE/$dir" cp -R "$RESTORE_DIR/workspace/$dir/"* "$OC_WORKSPACE/$dir/" 2>/dev/null && echo " ✅ $dir/" fi done fi ``` ### Technical Analysis The restore operation accepts a user-supplied archive and installs its contents into the active OpenClaw configuration and workspace wi ...[truncated 2080 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/migrate.sh:146

Finding

Backup Password Is Exposed Through OpenSSL Process Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/migrate.sh:157

Finding

AES-CBC Backup Encryption Does Not Authenticate Archive Integrity

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims full backup, encrypted safety, and one-command restore across machines, but the documented behavior is incomplete and asymmetric: some workspace content and memory are omitted, cron jobs are not restored, and restore may miss files. In a disaster-recovery or migration context, this can cause users to trust backups that are not actually complete, leading to data loss, broken restores, or false assurance about recoverability of sensitive operational state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and instructs shell execution (bash scripts/migrate.sh ...) but declares no explicit tool scope or permissions boundary. In a migration/backup skill, shell access can touch highly sensitive files like configs, memory, skills, and API-bearing auth profiles, so the absence of declared limits makes overbroad or unsafe execution more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

When --no-encrypt is used, the script writes a plaintext archive of configs, memory, skills, and workspace data to disk with no strong warning that sensitive material may be exposed. Because this skill is specifically designed to collect an entire agent environment, the resulting archive is likely to contain secrets, private notes, or executable content and is high-value if copied or accessed by others.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore flow copies configuration and workspace content directly into the live OpenClaw directories without any confirmation, preview, or backup of existing files. In a migration skill that restores scripts and skills, this can unintentionally destroy local state or replace trusted files with older or malicious content from the archive.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/migrate.sh (reported line 219)May include surrounding context.

sh

if [ -d "$RESTORE_DIR/config" ]; then
    echo "  → Restoring config"
    cp "$RESTORE_DIR/config/openclaw.json" "$OC_HOME/openclaw.json" 2>/dev/null && echo "    ✅ openclaw.json"
    chmod 600 "$OC_HOME/openclaw.json"
    if [ -d "$RESTORE_DIR/config/agents" ]; then
      cp -R "$RESTORE_DIR/config/agents/"* "$OC_HOME/agents/" 2>/dev/null && echo "    ✅ agents/"
      find "$OC_HOME/agents" -name "*.json" -exec chmod 600 {} \;

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/migrate.sh (reported line 222)May include surrounding context.

sh

if [ -d "$RESTORE_DIR/config" ]; then
    echo "  → Restoring config"
    cp "$RESTORE_DIR/config/openclaw.json" "$OC_HOME/openclaw.json" 2>/dev/null && echo "    ✅ openclaw.json"
    chmod 600 "$OC_HOME/openclaw.json"
    if [ -d "$RESTORE_DIR/config/agents" ]; then
      cp -R "$RESTORE_DIR/config/agents/"* "$OC_HOME/agents/" 2>/dev/null && echo "    ✅ agents/"
      find "$OC_HOME/agents" -name "*.json" -exec chmod 600 {} \;