GitHub Memory Sync

• Outcome: Review
• Latest audit: May 28, 2026 · 10:17 AM UTC
• Version: 1.1.0

Overview

This is a real GitHub backup skill, but it can upload highly sensitive OpenClaw memory and configuration files with weak guardrails and a risky cron default.

Install only if you intentionally want OpenClaw identity, memory, tool configuration, skills, and related workspace files backed up to GitHub. Use a private repository that you own, set GITHUB_REPO explicitly, remove or change the davinwang/openclaw-memory cron default, use a fine-grained token limited to that one repo, avoid placing the token in ~/.bashrc or inline cron entries, review the exact files before pushing, and keep a local backup before any restore.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes generic phrases such as “同步配置”, “恢复备份”, and “检查同步状态”, which are common operational requests not uniquely tied to GitHub backup of workspace memory. In an agent environment, this can cause the skill to activate on unrelated user intents and perform or prepare high-risk backup/restore actions involving sensitive files.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description advertises activation on broad phrases like “sync memory” and “migrate server,” which are ambiguous and likely to overlap with many benign administrative requests. Because this skill handles highly sensitive workspace files and credentials, accidental invocation increases the chance of unintended disclosure, overwrite, or destructive restore behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The push flow uploads the workspace, including memory, identity, tools, skills, avatars, and agent configuration files, to a remote GitHub repository without any explicit confirmation, preview, or warning about the sensitivity of the data being transmitted. In this skill’s context, these files likely contain secrets, personal data, prompts, and operational configuration, so silent exfiltration to a third-party service is materially dangerous.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The pull flow copies repository contents back into the local workspace and can overwrite trusted local configuration and memory files without prompting, backup, or conflict handling. Because this workspace includes agent identity, memory, tools, and skills, a remote repository compromise or operator mistake could replace local state with malicious or destructive content.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 添加定时任务（每天凌晨 2:30）
30 2 * * * cd /root/.openclaw/workspace/skills/github-memory-sync && \

• Confidence: 91% confidence
• Finding: crontab -e

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

**版本**: 1.1.0  
**作者**: OpenClaw Workspace  
**许可**: MIT

• Confidence: 87% confidence
• Finding: crontab -l 2>/dev/null; echo "30 2 * * * /root/.openclaw/workspace/skills/github-memory-sync; echo 'export GITHUBTOKEN="github_pat_xxx"' >> ~/.bashrc; echo 'export GITHUB_REPO="davinwang/openclaw-memo

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.