OpenClaw Upgrade Standard

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:36 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw upgrade guide, but it tells users to persistently copy credential and agent data into a workspace backup without clear permission, retention, or cleanup safeguards.

Review and adapt the backup step before installing or using this skill. Store credential backups with owner-only permissions, avoid copying the whole credentials directory unless necessary, keep backups outside broadly accessible workspaces, redact logs before public bug reports, and delete sensitive backups after rollback or verification.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35

Finding

Unnecessary Plaintext Credential Duplication in Agent Workspace

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–41
Vulnerability Type: Insecure storage and excessive collection of credentials
Risk Level: Medium

bash

BACKUP_DIR="$HOME/.openclaw/workspace/backups/openclaw-upgrade-$(date -u +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR"

# Config + credentials + agents
cp ~/.openclaw/openclaw.json "$BACKUP_DIR/"
cp -r ~/.openclaw/credentials "$BACKUP_DIR/" 2>/dev/null
cp -r ~/.openclaw/agents "$BACKUP_DIR/agents" 2>/dev/null

Technical Analysis

The procedure recursively copies the entire OpenClaw credential directory into a timestamped directory under ~/.openclaw/workspace. This duplicates sensitive material in plaintext inside a location intended for Agent workspace activity.

The backup directory is created with mkdir -p, so its permissions depend on the user's current umask; owner-only access is not explicitly enforced. The procedure also provides no encryption, credential-file allowlist, retention period, secure deletion, or warning that the backup contains secrets. Redirecting errors to /dev/null can conceal missing, partial, or permission-inconsistent backups.

The documented rollback restores only openclaw.json and the systemd service file. It does not restore the copied credential directory or agent state. Based on the documented workflow, collecting the entire credential store is therefore unnecessary for the implemented rollback and exceeds the minimum data access needed for the Skill's declared functionality.

Attack Path

1. A user follows the upgrade procedure.
2. The commands recursively copy the full credential directory into ~/.openclaw/workspace/backups/....
3. The plaintext backup remains after the upgrade because no cleanup or expiration procedure is defined.
4. An Agent, plugin, workspace synchronization process, local backup service, or local account with workspace read access discovers the backup.
5. The component or principal reads tokens or other authentica ...[truncated 899 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the credential backup unless credential restoration is demonstrably necessary for rollback.
2. Back up only explicitly identified files required for the upgrade and rollback rather than recursively copying the complete credentials and agents directories.
3. Store sensitive backups outside ~/.openclaw/workspace so Agents and workspace-oriented integrations do not routinely encounter them.
4. Enforce owner-only permissions before creating files:

bash

umask 077
install -d -m 700 "$BACKUP_DIR"

5. If credentials must be backed up, encrypt them with a user-controlled key and restrict each resulting file to mode 600.
6. Add a documented restoration step for every sensitive item retained; otherwise, do not collect it.
7. Define a short retention period and an automatic secure cleanup process after successful verification or rollback.
8. Replace blanket 2>/dev/null suppression with explicit error handling that reports failed or partial backups without printing secret contents.
9. Warn users that configuration, diagnostic output, and gateway logs may contain sensitive values and must be reviewed and redacted before being attached to a public bug report.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

| Version correct | `openclaw --version` | New version number |
| Doctor clean | `openclaw doctor` | No "invalid config" errors |
| WebChat | Send message in Dashboard | Response within 30s |
| Telegram | Send message to bot | Response within 30s |
| Agents listed | `openclaw status` | All agents shown |
| Cron jobs | Check cron list | Jobs intact |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The backup procedure copies sensitive configuration and credential material into a timestamped backup directory under the user's home workspace without any stated permission hardening, encryption, or retention controls. If that directory is later exposed through weak filesystem permissions, synced storage, other tools, or operator mishandling, it can preserve reusable secrets and extend the lifetime of sensitive session material.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

bash

BACKUP_DIR="$HOME/.openclaw/workspace/backups/openclaw-upgrade-$(date -u +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR"

# Config + credentials + agents
cp ~/.openclaw/openclaw.json "$BACKUP_DIR/"

Static analysis

No suspicious patterns detected.