T09 · Insecure Skill Coding Practices
Error
- Location
backup.py:26- Finding
Plaintext Upload of Sensitive OpenClaw Data to a Hard-Coded Default Repository
- Content
View full analysis
- Remediation
View remediation
Security audit
Backup 2 Github
Security checks for vulnerabilities and agentic risk
Overview
This backup skill is purpose-aligned, but it handles very sensitive OpenClaw data and can overwrite persistent local agent state from unverified GitHub content.
Install only if you are comfortable sending OpenClaw memory, profile, persona, configuration, scheduled tasks, and possibly credentials to GitHub. Use a dedicated private repository, explicitly set GITHUB_REPO, avoid command-line tokens, use a fine-grained token, review dry-run output, and do not restore unless you have verified the repository content and commit.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
backup.py:177- Finding
Untrusted Repository Content Can Poison Persistent Agent State During Restore
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
backup.py:229- Finding
GitHub Personal Access Token Can Be Exposed Through Command-Line Arguments
- Content
View full analysis
`. 2. The complete command is retained in shell history, captured by telemetry, or visible to another process or user able to inspect command lines. 3. An attacker retrieves the token. 4. The attacker uses the token within its granted GitHub permissions. 5. Repository access can then be used to read sensitive backups, modify future restore content, or delete backup history. ### Impact Assessment The obtainable privileges are those granted to the exposed GitHub token. The documentation requests broad `repo` scope, which may permit access to multiple private repositories rather than only the intended backup repository. For this Skill, token compromise can expose all stored backup data and can support persistent Agent-state poisoning by allowing an attacker to modify the repository used for restoration. ]]>- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Malformed and Unpinned Dependency Specification Creates Installation and Supply-Chain Risk
- Content
View full analysis
=1.59.0 python-dotenv>=1.0.0 ``` ### Technical Analysis The file contains a literal `requirements.txt:` header and YAML-style indentation rather than a conventional pip requirements list. The documented command is: ```bash pip install -r requirements.txt ``` The header is not a valid package requirement, so a standard pip installation may fail. The dependencies also use open-ended minimum versions without exact pins or integrity hashes. Consequently, installations performed at different times may obtain dependency versions that were not reviewed with this Skill. This reduces reproducibility and increases exposure to compromised or unexpectedly incompatible future releases. No evidence shows that `PyGithub` or `python-dotenv` is malicious. The finding concerns unsafe dependency management rather than a confirmed malicious package. ### Attack Path 1. A user follows the documented installation command. 2. Pip may reject the malformed header, preventing reliable installation. 3. If the malformed line is corrected locally, pip resolves any available versions satisfying the open-ended minimum constraints. 4. A future compromised or behaviorally incompatible dependency release could be installed without a source change in this project. 5. Such a dependency runs within the backup process and can access the GitHub token and sensitive backup contents. ### Impact Assessment The immediate impact is unreliable installation. The potential supply-chain impact is execution of dependency code with the same privileges as `backup.py`, including access to the GitHub token, network connection, and sensitive files loaded for backup. The audit found no evidence that this potential has already been exploited. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (13)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md This will: 1. Download the latest backup from GitHub 2. Restore files to their original locations 3. Print instructions to restart services **Important**: Restore will overwrite existing files. Confirm with `yes` when prompted.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The restore flow is documented to overwrite existing files in their original locations, which is a self-modifying behavior that can replace active configuration, identity, memory, cron, and script files. If the backup repository contents are stale, malicious, or compromised, restore could propagate unsafe changes into a fresh or existing OpenClaw installation.
- Content
md 2. Restore files to their original locations 3. Print instructions to restart services **Important**: Restore will overwrite existing files. Confirm with `yes` when prompted. ## How It Works
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - ✅ Backup only **personalized files** (not default OpenClaw) - ✅ Restore to fresh installation with identical state - ✅ Supports GitHub via Personal Access Token - ✅ Single-commit backup (clean history) - ✅ Dry-run mode to preview changes
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - ✅ Backup only **personalized files** (not default OpenClaw) - ✅ Restore to fresh installation with identical state - ✅ Supports GitHub via Personal Access Token - ✅ Single-commit backup (clean history) - ✅ Dry-run mode to preview changes
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - ✅ Backup only **personalized files** (not default OpenClaw) - ✅ Restore to fresh installation with identical state - ✅ Supports GitHub via Personal Access Token - ✅ Single-commit backup (clean history) - ✅ Dry-run mode to preview changes
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Install dependencies
pip install -r requirements.txt
Configure (create .env file)
GITHUB_TOKEN=ghp_your_token_here GITHUB_REPO=your-username/your-backup-repo
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly states that credentials and highly personal files may be included in backups, but it does not present a prominent warning that these secrets and personal data will be uploaded to a remote GitHub repository. Even if the repository is private, this creates meaningful risk of accidental disclosure, token leakage, or inappropriate long-term storage of sensitive data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly backs up highly sensitive files such as MEMORY.md, USER.md, IDENTITY.md, SOUL.md, TOOLS.md, cron configuration, and optionally credential JSON files to GitHub, but the description does not present a strong, prominent warning about the privacy and security consequences of transmitting this data off-host. Even with a private repository, this can expose personal profiles, operational details, and reusable credentials if the repository, token, or account is compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The backup operation uploads personal configuration and user data, including files like USER.md, IDENTITY.md, SOUL.md, MEMORY.md, cron jobs, and configuration, to a GitHub repository without an explicit privacy warning or per-run consent at upload time. In this skill context, the data appears highly sensitive and personalized, so silent transmission to a potentially public or misconfigured remote repository materially increases confidentiality risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The restore routine does not actually retrieve blob contents from the repository and instead treats commit-file metadata as if it were file data. This can corrupt restored configuration files, overwrite working files with invalid content, and create a denial-of-service condition by breaking the application's configuration or startup state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly states it will back up personalized configuration and user data to GitHub, but provides no warning, consent flow, or description of what data may be uploaded. This creates a real privacy and security risk because sensitive configuration, secrets, tokens, or personal data could be unintentionally exfiltrated to a remote repository, especially if the repository is misconfigured or public.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script presents user-facing output in Chinese, and similar Chinese-only messages appear throughout the file. This imposes a specific language on all users without offering a locale choice or documenting that the tool is intended only for a Chinese-speaking audience.
- Content
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The dependency specification uses a lower-bound constraint (python-dotenv>=1.0.0) rather than pinning to a known-safe version, while the package has known advisories. This creates supply-chain uncertainty: installations may resolve to an affected release depending on environment, mirrors, lockfiles, or future changes, making the security posture unverifiable.
- Content
Static analysis
No suspicious patterns detected.