T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.sh:21- Finding
Predictable and Insufficiently Protected Temporary Backup Files
- Content
View full analysis
- Remediation
View remediation
Security audit
safe-backup
Security checks for vulnerabilities and agentic risk
Overview
This backup skill is review-worthy because it packages broad OpenClaw state and workspace data and documents remote storage workflows that can persist or expose sensitive content.
Install only if you need this exact OpenClaw backup workflow. Prefer local encrypted storage, inspect the archive contents before keeping or transferring it, avoid committing raw backups to git, and do not use the remote rsync example without expanding exclusions and encrypting first. Run it only on machines where local temp-directory exposure is acceptable or after hardening the script's temporary-file handling.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
git push origin main
Delete local copy
rm -rf ~/safe-backup rm "$BACKUP_FILE"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
git push origin main
Delete local copy
rm -rf ~/safe-backup rm "$BACKUP_FILE"
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Credentials & Keys "*.key" "*.pem" ".env" ".env.*" "id_rsa*" "id_ed25519*"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md "*.secret" "*.token" "auth-profiles.json" "credentials.json" "api-keys.json" # Runtime generated (not needed for migration)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh "*.secret" "*.token" "auth-profiles.json" "credentials.json" "api-keys.json" # Runtime generated (not needed for migration)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger description includes broad everyday actions such as backup, export, or save state, which can cause the skill to activate in unintended contexts. For a skill that packages user state and workspace data, accidental invocation raises the risk of unnecessary data collection, staging sensitive files, or guiding a user into unsafe backup/export behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document states that the script does not automatically push to any remote, but later provides explicit instructions to clone a GitHub repository, extract backup contents into it, commit, and push, as well as rsync to a remote server. This contradiction can mislead users into underestimating the network exposure and sensitivity of the workflow.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a safe local backup workflow, but its documented storage options extend into publishing extracted backup contents to a GitHub repository and synchronizing data to a remote server. Even if framed as optional, these instructions materially increase the chance of exfiltrating configuration, memory, workspace content, or other sensitive state to third-party infrastructure.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The workflow directs users to extract backup contents into a Git repository and commit/push them, creating long-lived copies of application state that may persist in git history even after deletion. Because backups can still contain sensitive configuration, memory, and workspace data, this increases persistence and recovery difficulty if exposed.
- Content
md git clone https://github.com/YOUR_USERNAME/safe-backup.git ~/safe-backup # Extract backup mkdir -p ~/safe-backup/$(date +%Y-%m-%d) tar -xzf "$BACKUP_FILE" -C ~/safe-backup/$(date +%Y-%m-%d)/ # Commit and push
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
bash # Check if OpenClaw is installed ls -la ~/.openclaw"Permission denied"
Static analysis
No suspicious patterns detected.