Security audit

Claw Soul Backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill has a coherent purpose, but it asks agents to follow mutable remote instructions and supports persistent daily uploads of workspace archives without enough local control details.

Install only if you are comfortable sending encrypted workspace backups to Claw Vault and managing a recurring local cron job. Before enabling automation, confirm the exact files included, encryption method, destination, credential storage location, cron entry, log path, and how to disable and rotate credentials. Treat the remote SKILL.md as documentation, not as permission for new agent behavior unless reviewed separately.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:62
Finding: Mutable Remote Instructions Can Hijack Skill Behavior
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:46
Finding: Daily Cron Job Creates Persistent Unattended Data Uploads
Content: View full analysis
> /path/to/claw-vault-backup.log 2>&1 ``` ``` ### Technical Analysis The skill instructs the agent to create a local script and schedule it through cron. The resulting task survives the initiating skill run and repeatedly packages and transmits workspace content without requiring the original session to remain active. Although the skill requires explicit confirmation before the first upload, it does not separately require explicit confirmation before installing persistence or before each later upload. Persistent execution expands the security boundary beyond a one-time backup: future workspace contents are collected automatically, and any later compromise of the script, credentials, archive configuration, or remote endpoint affects every scheduled run. The sample also redirects all output to a long-lived log without defining secure ownership, permissions, rotation, or secret-redaction requirements. ### Attack Path 1. The user approves or performs an initial backup. 2. A local backup script is created to archive the workspace and call the remote `PUT` endpoint. 3. The provided cron entry is installed. 4. The cron daemon launches the script every day at 03:00, independently of the original agent session. 5. Current workspace content is archived and uploaded on every run. 6. If the script, credentials, remote instructions, destination, or archive scope is subsequently compromised, the altered behavior is repeatedly executed without renewed user review. ### Impact Assessment The scheduled task obtains the permissions of the ac ...[truncated 481 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:41
Finding: Backup Credentials Are Exposed in Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
Example:

bash
curl -sS -X POST "https://api.claw-vault.com/backup" \ -F "file=@workspace-backup.tar.gz.enc;type=application/octet-stream"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
Example:

bash
curl -sS -X POST "https://api.claw-vault.com/backup" \ -F "file=@workspace-backup.tar.gz.enc;type=application/octet-stream"

Static analysis

No suspicious patterns detected.