ClawHub
Back to skill

Security audit

OpenClaw Backup Rclone

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is generally coherent, but it backs up credentials, memory, and workspaces to remote storage by default without built-in encryption or strong restore safeguards.

Review before installing. Use this only with a trusted encrypted backup destination, avoid FTP, and disable credentials and memory unless you explicitly need them. Take a fresh snapshot before restore and test restores in a staging directory before extracting over /root/.openclaw.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/backup.sh:30
Finding

Sensitive credentials and memory are uploaded by default without archive-level encryption

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/backup.sh:154
Finding

Backup failures can leave unencrypted sensitive archives in temporary storage

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill documentation frames this as backing up 'overall configuration', but the listed backup scope explicitly includes highly sensitive and broader operational data such as workspace, memory, agents, and credentials. That mismatch can cause operators to authorize or schedule exfiltration of secrets and user data to arbitrary rclone backends without fully understanding the scope, increasing the chance of unintended data disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

3. 配置定时任务

bash
crontab -e
# 每天凌晨3点自动备份
0 3 * * * /root/.openclaw/workspace-main/skills/openclaw-backup/scripts/backup.sh \
  --remote tencentcos:backup-1252695297/openclaw-backup \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The restore instructions tell users to untar a backup directly into the live OpenClaw directory and restart the service, but they do not warn that this can overwrite current configuration, secrets, workspaces, and runtime state. In practice, an operator could irreversibly clobber production data or trigger downtime during an unsafe restore.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script explicitly includes highly sensitive directories such as credentials, memory, agents, skills, and workspace content in backups, then uploads the archive to an arbitrary rclone remote. In this skill context, remote exfiltration of secrets is the core behavior, so without a prominent user-facing warning, safer defaults, and scope controls, this creates a real confidentiality risk if the remote is misconfigured, untrusted, or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

All comments and runtime messages shown to users are written in Chinese, and the script provides no language selection or documented reason for a Chinese-only interface. This can violate language/locale policy when a skill forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.