T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup.sh:162- Finding
Overbroad export of sensitive OpenClaw state to an unrestricted Git remote
- Content
View full analysis
/dev/null | tr -d '"') if [ -z "$REPO_URL" ] || [ "$REPO_URL" = "null" ]; then echo "Error: OPENCLAW_BACKUP_REPO is not set in openclaw.json." echo 'Please set it via: openclaw config set skills.entries.openclaw-backup-restore.env.OPENCLAW_BACKUP_REPO "your-git-repo-url"' exit 1 fi SOURCE="${HOME}/.openclaw/" BACKUP_DIR="${HOME}/openclaw-backup/" LOG_FILE="/tmp/openclaw-backup.log" echo "[$(date)] Starting OpenClaw backup to ${REPO_URL}..." | tee -a "$LOG_FILE" if [ ! -d "$BACKUP_DIR" ]; then echo "Initializing backup directory at $BACKUP_DIR..." mkdir -p "$BACKUP_DIR" cd "$BACKUP_DIR" git init git remote add origin "$REPO_URL" else cd "$BACKUP_DIR" git remote set-url origin "$REPO_URL" || true fi SKILL_DIR_SHARED="${HOME}/.openclaw/skills/openclaw-backup-restore" SKILL_DIR_WORKSPACE="${HOME}/.openclaw/workspace/skills/openclaw-backup-restore" SKILL_DIR="" if [ -f "${SKILL_DIR_SHARED}/.gitignore" ]; then SKILL_DIR="$SKILL_DIR_SHARED" elif [ -f "${SKILL_DIR_WORKSPACE}/.gitignore" ]; then SKILL_DIR="$SKILL_DIR_WORKSPACE" fi if [ ! -f "${BACKUP_DIR}/.gitignore" ] && [ -n "$SKILL_DIR" ] && [ -f "${SKILL_DIR}/.gitignore" ]; then echo "Copying .gitignore from skill directory..." cp "${SKILL_DIR}/.gitignore" "${BACKUP_DIR}/.gitignore" fi rsync -av --delete \ --exclude-from="${BACKUP_DIR}/.gitignore" \ --exclude=".git/" \ --exclude=".gitignore" \ "$SOURCE" "$BACKUP_DIR" cd "$BACKUP_DIR" STATUS=$(git status --short) if [ -n "$STATUS" ]; then COMMIT_MSG=$(summarize_status "$STATUS") COMMIT_ ...[truncated 2676 chars]- Remediation
View remediation
` operations instead of `git add .`. 9. Verify that the destination repository is private, while documenting that repository privacy alone does not replace encryption. 10. Create the log with restrictive permissions and avoid recording repository URLs that may contain embedded credentials. ]]>