Self Preserve

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This instruction-only backup readiness skill is purpose-aligned and clearly scoped, with the main caveats being opt-in persistent backup scheduling and an unpinned installer command.

Before installing, verify or pin the ClawHub installer instead of blindly running a mutable `@latest` command. When using the skill, allow persistent scheduling only if you actually want recurring `openclaw backup create` jobs, and review backup-related cron entries if you later change your mind.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Mutable Package Version Executed During Installation

Content

View full analysis

Remediation

View remediation

install self-preserve ``` 2. Document the expected package registry and publisher identity so users can verify the package source. 3. Publish and verify package integrity information, such as the registry-provided integrity hash, where the installation workflow supports it. 4. Use a lockfile-backed or otherwise reproducible installation mechanism when practical. 5. Establish a controlled process for reviewing and deliberately updating the pinned installer version. 6. Advise users not to approve unexpected package installation prompts and to inspect the resolved package version before execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

md

**v1.0:** The skill now covers the full assessment lifecycle — local backup detection, automated scheduling, version control guidance for identity files, and offsite disaster-recovery awareness — all within a zero-permission, instruction-only security posture.

It does not read file contents or access credentials. See [SKILL.md](./SKILL.md) for the full assessment steps, safety rules, and scheduling options.

## Positioning

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

**v1.0:** The skill now covers the full assessment lifecycle — local backup detection, automated scheduling, version control guidance for identity files, and offsite disaster-recovery awareness — all within a zero-permission, instruction-only security posture.

It does not read file contents or access credentials. See [SKILL.md](./SKILL.md) for the full assessment steps, safety rules, and scheduling options.

## Positioning

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command uses npx clawhub@latest, which is not a pinned version and can fetch whatever package version is current at execution time. This creates a supply-chain risk: a compromised or breaking upstream release could be executed during installation without review, which is especially relevant for agent skills that may later influence local system actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill advertises the ability to create, persist, modify, and delete cron schedules, which introduces a persistence mechanism on the host. Even though the stated purpose is backups, persistence features are security-sensitive because they can survive the current session, repeatedly execute commands, and be abused if the skill logic or downstream inputs are later manipulated.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

Self-preserve checks whether your OpenClaw agent's standard state files (config, memory, identity, skills, workspace, cron) are covered by a recent backup. It runs `ls` to check file names and dates, then generates a readiness report showing what's protected and what's at risk.

**New in v0.3.0:** After the assessment, self-preserve can schedule automated backup cron jobs using CronCreate (persistent or session-only). It can also view, update, or remove existing backup schedules using CronList and CronDelete.

**New in v0.3.1:** The assessment now recommends version control (e.g. git) for identity files so changes can be rolled back incrementally rather than relying solely on full backups. Also recommends a session-end hook to auto-commit changes.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill includes an option to create durable scheduled tasks that persist across sessions by writing to .claude/scheduled_tasks.json. Even though this is user-gated and limited to backup scheduling, persistent automation increases attack surface because a compromised or misused schedule could continue running after the current session and affect future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- **No file contents read.** Uses only `ls -la` output (names, sizes, dates). Never `cat`, `head`, `tail`, `less`, or equivalent. The one exception is the optional `~/.openclaw/offsite.json` marker file (Step 8), which the skill may read to surface the user-declared offsite status; the skill never writes it.
- **Path allowlist.** Only `~/.openclaw/` (including the optional `~/.openclaw/offsite.json` marker) and `~/openclaw-backups/` are accessed.
- **No writes to agent state files.** The skill does not modify config, memory, identity, workspace, or skill files.
- **Cron schedule writes (user-gated).** Steps 6-7 call Claude-native tools (CronCreate, CronList, CronDelete) only after explicit user confirmation, and only to manage backup cron schedules. If the user opts in to persistent scheduling, CronCreate writes to `.claude/scheduled_tasks.json` (managed by the Claude harness); session-only schedules write nothing to disk. The skill never defaults to persistent without explicit user choice.
- **Advisory recommendations only (Step 5).** Step 5 may recommend that the user consider version control and session-end hooks for identity files, and may describe generic approaches for keeping an offsite copy of backups (git remotes, rsync/scp to a server the user controls, uploads to S3-compatible object storage). The skill does not implement, configure, or install any hooks, remotes, or upload jobs — the recommendations are informational only and do not name or promote any specific vendor, provider, or product.
- **No privilege escalation.** No sudo, no system-level access, no auto-load paths, no forced inclusion in other contexts.
- **No obfuscation.** All instructions are plain English markdown.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Then check for an offsite marker file that the user may have created to declare that backups are also being copied somewhere other than this machine:

text

ls -la ~/.openclaw/offsite.json 2>/dev/null

This marker is purely declarative — self-preserve never performs offsite copies and has no way to verify remote storage without network access. If the file exists, record its last-modified date as "Offsite last confirmed." If it does not exist, record "Offsite status: unknown." The marker is optional; its absence does not mean no offsite copy exists, only that the user has not declared one. See Step 8 for the marker format.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

This section actively offers to schedule automatic daily backups, which can create recurring behavior and potentially persistent state through CronCreate. While the intended action is benign, any feature that establishes recurring tasks can be abused or accidentally overreach if not tightly confirmed and bounded.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

Based on the report, suggest the most relevant actions from this list:

- **No backups found:** "Run `openclaw backup create` to create your first backup."
- **Stale backup (older than 24 hours with recent changes):** "Run `openclaw backup create` to capture recent changes."
- **No automated backup:** "I can schedule automatic daily backups for you — see Step 6."
- **All areas covered and recent:** "Your agent is well protected. No action needed."

Static analysis

No suspicious patterns detected.