ClawHub
Back to skill

Security audit

Complete Agent Backup

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real backup tool, but it needs Review because it handles credentials and executable agent state with unsafe restore and encryption behavior.

Review this before installing. Treat its backup files as containing passwords, tokens, conversations, and executable agent components. Do not restore archives from anyone you do not fully trust, do not rely on configured encryption unless you explicitly pass --encrypt, and do not use cloud upload without auditing the uploader and destination.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/restore.sh:61
Finding

Unvalidated archive extraction permits writes outside the restore directory

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
scripts/restore.sh:166
Finding

Restore imports untrusted executable scripts, skills, and persistent cron state

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/restore.sh:50
Finding

Predictable temporary paths expose plaintext credentials and decrypted backups

Content
View full analysis
/dev/null; then error "Decryption failed — wrong password?" fi ARCHIVE="$TEMP_ARCHIVE" trap "rm -f $TEMP_ARCHIVE" EXIT fi # ── Extract and validate ───────────────────────────────────────────────────── WORK_DIR="/tmp/hermes-restore-$$" mkdir -p "$WORK_DIR" trap "rm -rf $WORK_DIR" EXIT ``` The backup script similarly creates a predictable temporary directory and copies credentials into it: ```bash WORK_DIR="/tmp/${BACKUP_NAME}" ARCHIVE="${BACKUP_DIR}/${BACKUP_NAME}.tar.gz" mkdir -p "$BACKUP_DIR" "$WORK_DIR" ``` ```bash if [[ -f "${PLATFORM_HOME}/.env" ]]; then cp "${PLATFORM_HOME}/.env" "${WORK_DIR}/config/" info " .env (secrets)" fi ``` ```bash if [[ -d "${PLATFORM_HOME}/credentials" ]]; then mkdir -p "${WORK_DIR}/credentials" rsync -a "${PLATFORM_HOME}/credentials/" "${WORK_DIR}/credentials/" info " credentials" fi ``` ### Technical Analysis The scripts use predictable names under the shared `/tmp` directory instead of securely creating unique temporary files and directories with `mktemp`. They also do not set a restrictive `umask` before copying credentials, API keys, sessions, and decrypted archive content. In `restore.sh`, the cleanup trap for `TEMP_ARCHIVE` is replaced by the later trap for `WORK_DIR`. Consequently, the decrypted plaintext archive may remain in `/tmp` after the script exits. The decryption password is supplied through the `openssl` command-line argument: ```bash -pass pass:"$PASSWORD" ``` On systems exposing process arguments to other users, t ...[truncated 1072 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/backup.sh:7
Finding

Configured encryption is ignored when creating backups

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/backup.sh:298
Finding

Cloud upload executes an unverified user-writable external script

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A second independent mismatch is present: the document centers on a full backup platform, yet no actual executable implementation is shown here and static analysis reports major missing functionality. In a backup product, unsupported claims are security-relevant because users may assume recoverability, confidentiality, and off-site protection that are not real.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A second independent mismatch is present: the document centers on a full backup platform, yet no actual executable implementation is shown here and static analysis reports major missing functionality. In a backup product, unsupported claims are security-relevant because users may assume recoverability, confidentiality, and off-site protection that are not real.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

md
### Security Best Practices

1. **File Permissions**
   - Backups created with `chmod 600` (owner only)
   - Never `chmod 777` a backup

2. **Storage**

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This backup tool intentionally copies a .env file containing secrets into the backup set. While expected for a backup utility, it materially increases the sensitivity of the produced archive and magnifies the impact of any weakness in storage, encryption, upload, or retention handling.

Content

Scanner excerpt · scripts/backup.sh (reported line 110)May include surrounding context.

sh
fi
  
  # Environment (secrets)
  if [[ -f "${PLATFORM_HOME}/.env" ]]; then
    cp "${PLATFORM_HOME}/.env" "${WORK_DIR}/config/"
    info "  .env (secrets)"
  fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backup.sh (reported line 111)May include surrounding context.

sh
# Environment (secrets)
  if [[ -f "${PLATFORM_HOME}/.env" ]]; then
    cp "${PLATFORM_HOME}/.env" "${WORK_DIR}/config/"
    info "  .env (secrets)"
  fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backup.sh (reported line 112)May include surrounding context.

sh
# Environment (secrets)
  if [[ -f "${PLATFORM_HOME}/.env" ]]; then
    cp "${PLATFORM_HOME}/.env" "${WORK_DIR}/config/"
    info "  .env (secrets)"
  fi
  
  # Identity

Chaining Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

Using ls output piped to xargs rm is unsafe because filenames can contain whitespace, newlines, or leading dashes, causing incorrect deletion targets or option confusion. Since BACKUP_DIR comes from a user-controlled config file, malformed or adversarial filenames in that directory could make pruning delete unintended files matching the glob selection behavior.

Content

Scanner excerpt · scripts/backup.sh (reported line 308)May include surrounding context.

sh
BACKUP_COUNT=$(ls -t "${BACKUP_DIR}"/hermes-backup_*.tar.gz* 2>/dev/null | wc -l)
if [[ "$BACKUP_COUNT" -gt "$KEEP_COUNT" ]]; then
  info "Pruning old backups (keeping last ${KEEP_COUNT})..."
  ls -t "${BACKUP_DIR}"/hermes-backup_*.tar.gz* | tail -n +$((KEEP_COUNT + 1)) | xargs rm -f
  info "  Removed $((BACKUP_COUNT - KEEP_COUNT)) old backup(s)"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The restore logic restores a backed-up .env file directly into the agent home, which commonly contains API keys, tokens, and other secrets. Because the archive is extracted and its contents are trusted without authenticity verification or content validation, a tampered backup can inject attacker-controlled credentials or configuration, leading to account compromise, data exfiltration, or redirection of the agent to attacker infrastructure.

Content

Scanner excerpt · scripts/restore.sh (reported line 158)May include surrounding context.

sh
if [[ "$TARGET_PLATFORM" == "hermes" ]]; then
  # Hermes-specific files
  [[ -d "${BACKUP_DIR}/config" ]] && restore_item "${BACKUP_DIR}/config/config.yaml" "${TARGET_HOME}/config.yaml" "config.yaml"
  [[ -f "${BACKUP_DIR}/config/.env" ]] && restore_item "${BACKUP_DIR}/config/.env" "${TARGET_HOME}/.env" ".env"
  [[ -d "${BACKUP_DIR}/identity" ]] && restore_item "${BACKUP_DIR}/identity/SOUL.md" "${TARGET_HOME}/SOUL.md" "SOUL.md"
  [[ -d "${BACKUP_DIR}/memories" ]] && restore_item "${BACKUP_DIR}/memories/" "${TARGET_HOME}/memories" "memories"
  [[ -d "${BACKUP_DIR}/sessions" ]] && restore_item "${BACKUP_DIR}/sessions/" "${TARGET_HOME}/sessions" "sessions"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises and instructs use of shell-capable operations but declares no explicit tool scope or permission boundaries. For a backup skill that handles secrets, filesystem access, restore actions, and cloud configuration, missing tool restrictions increases the chance of overbroad execution or accidental invocation with more access than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language trigger 'Create a backup of my agent' is broad and could cause unintended invocation in ordinary conversation. In the context of a skill that archives highly sensitive files, accidental triggering could collect secrets, sessions, and workspace contents without the user intending to start a backup operation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

md
1. **File Permissions**
   - Backups created with `chmod 600` (owner only)
   - Never `chmod 777` a backup

2. **Storage**
   - Keep local backups in encrypted disk/VeraCrypt

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

"Permission denied" on backup

bash
# Check directory permissions
ls -la ~/backups/hermes/

# Fix
chmod 700 ~/backups/hermes/

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

ls -la ~/backups/hermes/

Fix

chmod 700 ~/backups/hermes/

text

### "Backup is corrupted"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script creates a plaintext tar.gz archive containing highly sensitive material such as .env files, auth.json, tokens, credentials, sessions, and state before encryption is optionally applied. This leaves secrets exposed by default and also creates a window where sensitive data exists unencrypted on disk, which is especially risky on shared systems, compromised hosts, or if the backup directory is synced or monitored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script can upload archives that contain credentials and conversation/session data to cloud storage without enforcing encryption or presenting a strong confirmation about remote transmission of secrets. If cloud configuration is insecure, misdirected, or compromised, this can lead to broad disclosure of sensitive agent data and authentication material.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

md
AUTO_BACKUP="/tmp/hermes-pre-restore-$(date +%Y%m%d_%H%M%S).tar.gz"
  warn "Creating safety backup of current state..."
  tar -czf "$AUTO_BACKUP" -C "$HOME" ".${TARGET_PLATFORM}" 2>/dev/null || true
  chmod 600 "$AUTO_BACKUP"
  info "Safety backup: $AUTO_BACKUP"
  echo ""
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/backup.sh (reported line 281)May include surrounding context.

sh
AUTO_BACKUP="/tmp/hermes-pre-restore-$(date +%Y%m%d_%H%M%S).tar.gz"
  warn "Creating safety backup of current state..."
  tar -czf "$AUTO_BACKUP" -C "$HOME" ".${TARGET_PLATFORM}" 2>/dev/null || true
  chmod 600 "$AUTO_BACKUP"
  info "Safety backup: $AUTO_BACKUP"
  echo ""
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/config.sh (reported line 185)May include surrounding context.

sh
AUTO_BACKUP="/tmp/hermes-pre-restore-$(date +%Y%m%d_%H%M%S).tar.gz"
  warn "Creating safety backup of current state..."
  tar -czf "$AUTO_BACKUP" -C "$HOME" ".${TARGET_PLATFORM}" 2>/dev/null || true
  chmod 600 "$AUTO_BACKUP"
  info "Safety backup: $AUTO_BACKUP"
  echo ""
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/restore.sh (reported line 122)May include surrounding context.

sh
AUTO_BACKUP="/tmp/hermes-pre-restore-$(date +%Y%m%d_%H%M%S).tar.gz"
  warn "Creating safety backup of current state..."
  tar -czf "$AUTO_BACKUP" -C "$HOME" ".${TARGET_PLATFORM}" 2>/dev/null || true
  chmod 600 "$AUTO_BACKUP"
  info "Safety backup: $AUTO_BACKUP"
  echo ""
fi