ClawSync

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 2.0.0

Overview

ClawSync is a real sync tool, but it reaches beyond its stated scope by copying broad OpenClaw data and using weak or risky sync/auth setup paths.

Review this carefully before installing. Use it only if you are comfortable with broad OpenClaw workspace data being copied to a local vault and then to the selected storage provider, and avoid enabling background sync or cloud/dashboard features until the sync scope, restore confirmations, provider authentication, and installer behavior are tightened.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill declares powerful tools (`exec`, `file`) and includes shell-command-driven behaviors, but the finding indicates capability/permission disclosure is incomplete. That mismatch can cause users or policy systems to underestimate the skill's ability to access environment data or execute commands, which is risky in a sync/migration skill that may touch sensitive files and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a serious description-behavior mismatch: the skill is presented as syncing limited knowledge/package data, but the underlying behavior reportedly mirrors the full OpenClaw directory, exposes dashboard file operations across profiles, and uses weak cloud authentication semantics. Users may consent to a narrow backup feature while unintentionally granting access to far broader data, and the cloud/dashboard components materially expand the attack surface.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The documentation gives conflicting guarantees about whether data is globally synced across machines or isolated per profile. In a backup/sync product, ambiguity about data boundaries is security-relevant because users may store sensitive information assuming isolation when it may actually replicate elsewhere, or overwrite data unintentionally during restore/pull operations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The dashboard auth endpoint issues a bearer token after checking only that the supplied email and vault_id pair exists in the database. Neither a password, proof of inbox control, possession of a registered sync key, nor any second factor is required, so anyone who can guess or obtain those two values can mint a valid JWT and then use all dashboard-authorized endpoints, including reading files, copying files, registering keys, and revoking keys.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The pull/migration path does more than restore data: after pulling a vault-controlled requirements file, it offers to install missing packages by invoking a separate installer script. That extends the trust boundary from data sync into code/package execution, so a compromised vault or provider could influence software installation on the target machine during restore.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: After restoring files into the local vault, the script also copies USER.md and MEMORY.md into an external OpenClaw workspace path from config. This creates an unexpected side effect outside the declared vault boundary, allowing remote vault contents to influence another application's live workspace and potentially overwrite trusted local context there.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The pull path restores a remote `openclaw` directory directly into the local OpenClaw installation, expanding the trust boundary far beyond vault data sync. A compromised cloud account or malicious remote payload could silently modify executable code, skills, or runtime files on the local machine, turning sync into a software update channel without integrity controls or user consent.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The provider disables SSH host key verification with StrictHostKeyChecking=no for push operations, which allows a man-in-the-middle attacker to impersonate the remote server and intercept or tamper with synchronized vault contents. In this skill's context, the synced data includes identity, memory, requirements, and project knowledge, making trust-on-first-use bypass especially dangerous for a portable identity vault.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The provider automatically installs rclone and, on fallback paths, executes a remote installer script fetched over the network. For a sync provider, silently modifying the host and running third-party code is an unnecessary expansion of privilege and attack surface, especially because compromise of the installer source or network path would lead to arbitrary code execution.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The helper forces SSH with StrictHostKeyChecking=no, which disables server identity verification and makes the sync channel vulnerable to man-in-the-middle attacks. Because this provider syncs an identity vault and automatically fetches, resets, pulls, and pushes sensitive data, a network attacker or malicious gateway could impersonate the Git server and tamper with or exfiltrate vault contents.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The provider auto-installs rclone by invoking package managers and, if needed, piping a remotely fetched script directly into a shell. This creates a supply-chain and remote-code-execution risk because any compromise of the install URL, network path, or installer script would execute code on the user's machine during normal provider setup.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The engine does more than sync its own vault metadata: it imports an external OpenClaw workspace into the vault before push, expanding the trust boundary beyond what the skill description suggests. This can cause unintended collection and replication of unrelated workspace data, especially if users expect only vault-scoped content to be synced.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: `rsync -a --delete` copies the entire configured OpenClaw directory into the vault, excluding only a few folders, which exceeds the stated scope of syncing selected identity/vault data. Because this is automatic and destructive, it can silently ingest sensitive files and delete vault-side content to match the source tree.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: On pull, the script writes the mirrored OpenClaw copy from the vault back into the live OpenClaw directory, meaning remote state can overwrite or repopulate a working environment. In the context of a sync skill, this is more dangerous because a compromised provider or mistaken sync can modify active workspace files, not just backups.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The stop logic uses broad process-killing patterns such as `pkill -f "fswatch.*clawsync"`, which can match unrelated processes whose command lines happen to contain those terms. This grants the skill the ability to terminate processes outside its own process tree, which is unnecessary for vault sync and can disrupt other applications or user workflows.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The header and usage text describe this as a tracker that scans and writes requirements, but the script also includes an install mode that can modify the host by installing packages. That mismatch is dangerous because users may trust or auto-run a supposedly passive inventory tool without realizing it has a system-changing capability.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The install command expands the skill from vault synchronization into direct package installation on the host, including privileged package managers. In an agent-skill context, this is more dangerous because a synced requirements file becomes a source of executable system changes, increasing the blast radius of a compromised vault or mistaken package list.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code stores the bearer token, vault ID, and email in localStorage, which is persistent and readable by any script executing in the page origin. If this origin is ever exposed to XSS, third-party script compromise, or browser extension scraping, an attacker can recover the token and access the user's vault dashboard session.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The catch block shows a successful signup message and reveals next-step instructions even when the backend request fails, so users are misled into believing an account exists. In a security-sensitive sync product, this can cause users to trust a non-existent or incomplete provisioning state and proceed with setup under false assumptions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README promotes syncing 'knowledge, memory, and system packages across all your machines' and automatic pushes to third-party storage, but it does not give a prominent upfront warning that sensitive agent data may be continuously transmitted off-device. In a skill specifically designed to aggregate identity, memory, and project context, omission of a clear privacy/data-transfer warning can cause users to expose sensitive information unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start flow encourages users to run `clawsync sync start` immediately after provider setup, which implies a background daemon will begin ongoing synchronization without a prominent warning about continuous uploads. Because this skill handles identity and memory data, starting silent background sync from the setup path increases the risk of accidental exfiltration or privacy loss.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Broad triggers like `sync`, `backup`, `restore`, `cloud`, and `packages` are likely to activate on ordinary user requests unrelated to this specific skill. In a skill with command execution and data-sync semantics, accidental invocation can lead to unintended file operations, provider setup, or data transmission without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Promoting automatic continuous syncing 'like iCloud' without a prominent, concrete warning about ongoing transmission and exact synced content scope undermines informed consent. Given the skill handles identity, memory, packages, optional credentials, and multiple remote providers, users may expose sensitive data continuously without understanding what leaves the machine and when.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The `profile pull` flow restores a selected remote profile immediately after logging, with no confirmation, dry-run, or backup step in this entrypoint. Because this skill manages a user's identity vault, knowledge, and memory across machines, pulling the wrong profile or a stale/compromised remote state could overwrite important local state and cause data loss or cross-device contamination.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The pull operation overwrites local vault files and recursively copies project contents without prompting, conflict detection, backup, or version checks. This allows remote state to silently replace trusted local configuration and content, causing data loss and potentially planting malicious configuration or project artifacts that will be consumed later.

VirusTotal

66/66 vendors flagged this skill as clean.