Openclaw Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This backup skill matches its stated purpose, but its scripts and guidance handle sensitive OpenClaw data unsafely enough that users should review it before installing.

Treat this as a Review install. Only use it after hardening the scripts: create private random temp directories, keep plaintext archives inside protected temp storage with cleanup traps, avoid passing backup passwords through command-line arguments or long-lived environment variables, validate and show cron entries before installing them, and do not follow the documented chmod -R 755 or live-directory deletion examples.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_encrypted.sh:8
• Finding: Predictable and Insufficiently Protected Temporary Backup Storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup_encrypted.sh:8-17, 44-54` **Vulnerability Type**: Unsafe temporary directory handling **Risk Level**: High ### Complete Code Snippet ```bash DATE_STR="$(date +"%Y-%m-%d_%H-%M-%S")" TMP_DIR="/tmp/openclaw_backup_$DATE_STR" ARCHIVE_NAME="openclaw_backup_$DATE_STR.tar.gz" ENCRYPTED_NAME="openclaw_backup_$DATE_STR.tar.gz.enc" STATE_DIR_NEW="$HOME/.openclaw" STATE_DIR_OLD="$HOME/.clawdbot" mkdir -p "$BACKUP_ROOT" mkdir -p "$TMP_DIR" if [ -d "$STATE_DIR_NEW" ]; then echo "✓ 发现: $STATE_DIR_NEW" cp -a "$STATE_DIR_NEW" "$TMP_DIR/" FOUND_ANY=1 fi if [ -d "$STATE_DIR_OLD" ]; then echo "✓ 发现: $STATE_DIR_OLD" cp -a "$STATE_DIR_OLD" "$TMP_DIR/" FOUND_ANY=1 fi ``` Equivalent behavior also appears in `scripts/backup.sh:8-16, 24-34` and is reproduced in `SKILL.md`. ### Technical Analysis The temporary directory name is derived from the current timestamp and is therefore predictable. It is created in the shared `/tmp` namespace with `mkdir -p`, rather than through an atomic facility such as `mktemp`. The script does not set a restrictive `umask`, verify that the path is a newly created directory owned by the current user, or explicitly assign mode `0700`. The directory receives complete copies of `~/.openclaw` and `~/.clawdbot`, which the project documentation states may contain API keys, bot tokens, conversations, memory, and configuration data. A pre-existing path can at minimum cause denial of service. Depending on platform behavior, default permissions, copied file modes, and local process access, temporary content may also become visible to unauthorized local users or monitoring processes. ### Attack Path 1. A local attacker predicts the timestamp-based `/tmp/openclaw_backup_YYYY-MM-DD_HH-MM-SS` name or continuously monitors for matching paths. 2. The victim starts a backup. 3. The script copies the complete OpenClaw state into the shared temporary namespace. 4. If dire ...[truncated 576 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create the directory atomically with a random name: ```bash umask 077 TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/openclaw_backup.XXXXXXXX")" ``` - Verify that the result is a directory owned by the current user. - Explicitly enforce mode `0700` on the temporary directory. - Store the intermediate archive inside that protected directory rather than directly under `/tmp`. - Register cleanup immediately after creation: ```bash cleanup() { rm -rf -- "$TMP_DIR" } trap cleanup EXIT HUP INT TERM ``` - Apply the same correction to both backup scripts and to the code examples embedded in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_encrypted.sh:70
• Finding: Backup Password Exposed Through OpenSSL Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup_encrypted.sh:70-76` **Vulnerability Type**: Secret exposure through command-line arguments **Risk Level**: High ### Complete Code Snippet ```bash echo "📦 打包中..." tar -czf "/tmp/$ARCHIVE_NAME" -C "$TMP_DIR" . echo "🔐 加密中..." openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \ -in "/tmp/$ARCHIVE_NAME" \ -out "$BACKUP_ROOT/$ENCRYPTED_NAME" \ -pass pass:"$BACKUP_PASSWORD" ``` The same insecure invocation is reproduced in `SKILL.md:185-192`. ### Technical Analysis The `-pass pass:"$BACKUP_PASSWORD"` option places the expanded password in the OpenSSL process argument vector. Process arguments may be visible through process-inspection utilities, `/proc` interfaces on applicable systems, endpoint monitoring, audit logs, crash telemetry, or other processes running under the same account. Although the shell variable is quoted against shell expansion, quoting does not prevent the expanded value from becoming an OpenSSL command-line argument. The password protects an archive containing particularly sensitive application state. Exposure therefore compromises both existing archives protected by the same password and future archives if the password is reused. ### Attack Path 1. The victim starts an encrypted backup. 2. The script invokes OpenSSL with the plaintext password in its argument vector. 3. A local process or monitoring mechanism captures the OpenSSL command line while encryption is running. 4. The attacker obtains or copies an encrypted backup. 5. The captured password is used to decrypt the archive and recover credentials, private state, and conversation data. ### Impact Assessment An attacker who can inspect the invoking user's processes or process telemetry can obtain the complete backup password. This gives confidentiality access to every archive encrypted with that password, but it does not independently grant higher operating-system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Pass the password through a protected file descriptor rather than the process argument vector. For example: ```bash exec 3<<<"$BACKUP_PASSWORD" openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \ -in "$TMP_DIR/$ARCHIVE_NAME" \ -out "$BACKUP_ROOT/$ENCRYPTED_NAME" \ -pass fd:3 exec 3<&- unset BACKUP_PASSWORD BACKUP_PASSWORD_CONFIRM ``` Additional hardening should include: - Avoid encouraging long-lived plaintext password environment variables. - Integrate with a credential manager or read the secret interactively for manual backups. - For scheduled backups, retrieve the secret from a narrowly permissioned credential store. - Clear shell variables as soon as encryption completes. - Update the duplicate implementation and decryption guidance in `SKILL.md` and `README.md`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_cron.sh:6
• Finding: Persistent Cron Command Injection Through Unvalidated Schedule and Script Values<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_cron.sh:6-7, 31-34, 43-55` **Vulnerability Type**: Persistent command injection and unsafe cron modification **Risk Level**: High ### Complete Code Snippet ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BACKUP_SCRIPT="${OPENCLAW_BACKUP_SCRIPT:-$SCRIPT_DIR/backup_encrypted.sh}" case $CHOICE in 4) echo "请输入 cron 表达式（如 '0 2 * * *' 代表每天凌晨2点）:" read -p "> " CRON_EXPR DESC="自定义: $CRON_EXPR" ;; esac if crontab -l 2>/dev/null | grep -q "openclaw.*backup"; then echo "" echo "⚠️ 发现已有 OpenClaw 备份任务，是否覆盖？[y/N]" read -p "> " CONFIRM if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then echo "取消操作" exit 0 fi crontab -l 2>/dev/null | grep -v "openclaw.*backup" | crontab - fi (crontab -l 2>/dev/null; echo "$CRON_EXPR $BACKUP_SCRIPT >> /tmp/openclaw_backup.log 2>&1") | crontab - ``` The same implementation is embedded in `SKILL.md:232-283`. ### Technical Analysis The custom `CRON_EXPR` is read from user input and inserted verbatim into the user's crontab. `OPENCLAW_BACKUP_SCRIPT` is likewise accepted from the environment without validation or safe serialization. The script does not reject newlines, control characters, additional cron fields, shell metacharacters, or inline commands. A crafted value can therefore introduce an additional crontab line or change the command that cron executes. Because the generated entry is installed through `crontab -`, the injected command persists across shell sessions and runs with the privileges of the affected user. The existing-entry detection and removal expression, `openclaw.*backup`, is also overly broad. It can match and remove unrelated user cron entries containing those words. The persistence mechanism itself is directly related to the declared automatic-backup feature and remains user-level. The vulnerability is the unvalidated construction and broad modifica ...[truncated 1030 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Reject all newlines, carriage returns, NULs, and other control characters. - Validate custom schedules against a strict five-field cron grammar or use a trusted cron-expression parser. - Resolve `BACKUP_SCRIPT` to a canonical absolute path. - Require the path to reference a regular executable file owned by the current user and located in an expected directory. - Shell-quote the command path safely before writing it to crontab. - Use a unique exact marker rather than a broad content expression: ```bash MARKER="# openclaw-backup-managed" ``` - Remove or replace only the exact marked entry. - Show the complete proposed cron entry and require explicit confirmation before installation. - Add an explicit uninstall command or script. - Apply equivalent fixes to the implementation embedded in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_encrypted.sh:63
• Finding: Failure Paths Leave Plaintext Backups Behind and May Keep the Gateway Stopped<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup_encrypted.sh:1-2, 63-85` **Vulnerability Type**: Missing failure-safe cleanup and service restoration **Risk Level**: High ### Complete Code Snippet ```bash #!/bin/bash set -euo pipefail if command -v openclaw >/dev/null 2>&1; then echo "⏸ 停止网关..." openclaw gateway stop 2>/dev/null || true sleep 2 fi echo "📦 打包中..." tar -czf "/tmp/$ARCHIVE_NAME" -C "$TMP_DIR" . echo "🔐 加密中..." openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \ -in "/tmp/$ARCHIVE_NAME" \ -out "$BACKUP_ROOT/$ENCRYPTED_NAME" \ -pass pass:"$BACKUP_PASSWORD" shasum -a 256 "$BACKUP_ROOT/$ENCRYPTED_NAME" > "$BACKUP_ROOT/$ENCRYPTED_NAME.sha256" rm -f "/tmp/$ARCHIVE_NAME" rm -rf "$TMP_DIR" if command -v openclaw >/dev/null 2>&1; then echo "▶️ 重启网关..." openclaw gateway start 2>/dev/null || true fi ``` ### Technical Analysis The script uses `set -e`, so an error in archive creation, encryption, checksum generation, or cleanup terminates execution immediately. Cleanup and gateway restart are performed only on the normal success path. No `EXIT`, `INT`, `TERM`, or `HUP` trap ensures restoration. Once `tar` succeeds, a plaintext compressed archive containing the complete OpenClaw state exists directly under `/tmp`. If OpenSSL or a later command fails, that archive remains on disk. If the gateway was successfully stopped, the same failure can prevent it from being restarted. The script also ignores the result of `openclaw gateway stop`, making it impossible to accurately track whether this invocation changed service state. ### Attack Path 1. The victim starts an encrypted backup. 2. The script stops the OpenClaw gateway and creates a plaintext archive. 3. Encryption or checksum generation is made to fail, for example through exhausted disk space, destination permission errors, a missing OpenSSL binary, process termination, or another runtime fault. 4. `set -e` terminates the script before c ...[truncated 603 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Install cleanup and service-restoration traps before stopping the gateway: ```bash GATEWAY_STOPPED=0 cleanup() { status=$? rm -f -- "$TMP_DIR/$ARCHIVE_NAME" rm -rf -- "$TMP_DIR" if [ "$GATEWAY_STOPPED" -eq 1 ]; then openclaw gateway start >/dev/null 2>&1 || true fi exit "$status" } trap cleanup EXIT HUP INT TERM ``` Further measures: - Store the plaintext archive inside a mode-`0700` random temporary directory. - Set `GATEWAY_STOPPED=1` only after a confirmed successful stop. - Write encrypted output to a temporary destination and atomically rename it after successful encryption. - Remove partial encrypted output when encryption fails. - Consider avoiding gateway shutdown unless required for consistency and explicitly requested. - Apply the same lifecycle controls to the unencrypted script where service restoration is relevant. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: ADVANCED.md:27
• Finding: Documented Exclusion Procedure Deletes Live OpenClaw Data<![CDATA[ ## Vulnerability Details **File Location**: `ADVANCED.md:27-40` **Vulnerability Type**: Destructive backup guidance **Risk Level**: High ### Complete Code Snippet ```bash ### 排除特定文件 编辑 `scripts/backup.sh`，在 `cp -a` 之前添加： ```bash # 排除日志文件（节省空间） find "$STATE_DIR_NEW" -name "*.log" -delete 2>/dev/null || true # 排除 node_modules（如果存在） find "$STATE_DIR_NEW" -name "node_modules" -type d -exec rm -rf {} + 2>/dev/null || true # 排除临时文件 find "$STATE_DIR_NEW" -name "*.tmp" -delete 2>/dev/null || true ``` ``` Equivalent destructive guidance appears in `SKILL.md:497-504`. ### Technical Analysis The documentation presents these commands as backup exclusions and instructs users to place them before the source directory is copied. However, each command operates directly on `STATE_DIR_NEW`, which points to the live `~/.openclaw` directory. Consequently, the commands do not merely omit files from an archive. They recursively delete matching data from the active application state. The `|| true` suffix suppresses errors and makes partial deletion less visible. Deleting logs can destroy diagnostic or forensic evidence. Deleting dependency directories can break installed skills or application components. Broad `*.tmp` deletion may remove files that are still required by running processes. ### Attack Path 1. A user experiences a large backup and follows the documented optimization procedure. 2. The user inserts the recommended commands before `cp -a`. 3. The next backup runs the `find` commands against the live OpenClaw state. 4. Logs, temporary files, and every matching `node_modules` directory are recursively deleted. 5. The user may discover the damage only after application failures or when data is needed for troubleshooting. ### Impact Assessment The commands execute with the user's privileges and can delete any matching object reachable under the user's OpenClaw state directory. Impact includes permanent user-data loss, destroyed forensic records, broken ...[truncated 125 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace destructive source modification with archive-native exclusions: ```bash tar \ --exclude='*.log' \ --exclude='*.tmp' \ --exclude='*/node_modules' \ -czf "$BACKUP_ROOT/$ARCHIVE_NAME" \ -C "$HOME" .openclaw ``` Alternatively: - Copy the source into a protected temporary directory first. - Verify that the cleanup target is beneath the expected temporary directory. - Remove excluded material only from that temporary copy. - Clearly distinguish “exclude from backup” from “delete source data.” - Remove the destructive examples from both `ADVANCED.md` and `SKILL.md`. - Recommend creating and validating a backup before any optional cleanup of live data. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: FAQ.md:337
• Finding: Recursive World-Readable Permission Recommendation Exposes Sensitive State<![CDATA[ ## Vulnerability Details **File Location**: `FAQ.md:337-341` **Vulnerability Type**: Insecure filesystem permission guidance **Risk Level**: Medium ### Complete Code Snippet ```bash # 检查权限 ls -la ~/.openclaw # 修复权限 chmod -R 755 ~/.openclaw chmod 600 ~/.openclaw/config.yaml ``` ### Technical Analysis `chmod -R 755 ~/.openclaw` applies mode `0755` to both directories and regular files throughout the complete OpenClaw state tree. This makes files readable by every local user and marks ordinary data files as executable. Only `config.yaml` is subsequently restored to mode `0600`. Other files may still contain API keys, bot tokens, memory, private conversations, logs, cached data, or skill-specific credentials. The recommendation therefore conflicts with the project's own warning that the state directory contains sensitive information. Recursive permission replacement also destroys intentionally restrictive modes on credential files and other protected resources. ### Attack Path 1. A user encounters a permission error and follows the FAQ. 2. `chmod -R 755` makes nearly all files under `~/.openclaw` world-readable. 3. Another local account enumerates the directory and reads exposed state files. 4. The attacker extracts private content or credentials from any file other than the separately corrected `config.yaml`. 5. Exposed credentials may then be used against their associated external services. ### Impact Assessment Any local user who can traverse the user's home directory can potentially read the affected files. Exposed tokens may permit access to external APIs, messaging bots, or services with the privileges associated with those credentials. The command itself does not grant write access to other users or elevate them to root. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Do not apply recursive mode `0755` to an application state directory. Use separate directory and file permissions: ```bash find "$HOME/.openclaw" -type d -exec chmod 700 {} + find "$HOME/.openclaw" -type f -exec chmod 600 {} + ``` Then grant executable permission only to explicitly identified scripts that require it: ```bash find "$HOME/.openclaw/skills" -type f -path '*/scripts/*.sh' -exec chmod 700 {} + ``` Additional hardening: - Preserve existing restrictive permissions where possible instead of replacing all modes. - Verify ownership before changing permissions. - Avoid following symbolic links during recursive operations. - Document platform-specific permission diagnostics rather than presenting broad recursive changes as a universal fix. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (78)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

du -sh "$STATE_DIR_NEW"/* | sort -hr | head -10

# 根据输出，排除大文件
rm -rf "$TMP_DIR/.openclaw/logs"
rm -rf "$TMP_DIR/.openclaw/.npm"
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 根据输出，排除大文件
rm -rf "$TMP_DIR/.openclaw/logs"
rm -rf "$TMP_DIR/.openclaw/.npm"
```

### 3. 分片备份（大文件）

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 清理旧备份（保留最近5个）
cd ~/Desktop/OpenClaw_Backups
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f
```

### 问题3：cron任务失败

• Confidence: 82% confidence
• Finding: The cleanup pipeline uses 'ls | tail | xargs rm -f', which is unsafe for filenames containing whitespace, newlines, or leading hyphens and may delete unintended files. In a backup directory containing unusual or attacker-planted filenames, this can cause accidental data loss or broaden the deletion scope.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

�2：磁盘空间不足

**诊断**：
```bash
df -h
du -sh ~/.openclaw
```

**解决**：
```bash
# 清理旧备份（保留最近5个）
cd ~/Desktop/OpenClaw_Backups
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f
```

### 问题3：cron任务失败

**诊断**：
```bash
# 查看cron日志
tail -f /tmp/openclaw_backup.log

# 手动测试cron环境
env -i HOME=$HOME /bin/bash -c 'crontab -l | grep openclaw'
```

**解决**：
- 使用绝对路径
- 设置 PATH 环境变量
- 检查权限

---

## 📊 备份策略对比

| 策略 | 优点 | 缺点 | 适用场景 |
|------|------|------|---------|
| **完整备份** | 简单、快速恢复 | 占用空间大 | 每周/月备份 |
| **增量备份** | 节省空间 | 恢复复杂 | 每日备份 |
| **最小备份** | 速度快、空间小 | 不完整 | 紧急备份 |
| **3-2-1备份** | 最安全 | 管理复杂 | 生产环境 |

---

## 🔗 相关资源

- [OpenClaw官方文档](https://docs.openclaw.ai)
- [备份最佳实

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Chaining Abuse

High

• Category: Tool Misuse

Content

rm openclaw_backup_2026-03-01_*.tar.gz*

# 方式2：只保留最近5个
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f
ls -t openclaw_backup_*.tar.gz.enc.sha256 | tail -n +6 | xargs rm -f

# 方式3：删除30天前的备份

• Confidence: 95% confidence
• Finding: The pipeline ls -t ... | tail -n +6 | xargs rm -f chains file selection directly into deletion, which is error-prone and offers no confirmation. Filenames with unusual characters and unexpected glob matches can lead to accidental removal of backups beyond what the user intended.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 方式2：只保留最近5个
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f
ls -t openclaw_backup_*.tar.gz.enc.sha256 | tail -n +6 | xargs rm -f

# 方式3：删除30天前的备份
find . -name "openclaw_backup_*.tar.gz*" -mtime +30 -delete

• Confidence: 95% confidence
• Finding: This second chained deletion command removes checksum files using the same unsafe pattern. In a backup context, deleting integrity metadata can silently reduce the ability to verify archive correctness and impede recovery confidence.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **排除大文件**：
   ```bash
   # 排除日志
   rm -rf ~/.openclaw/logs/*.log
   
   # 排除node_modules（如果有）
   rm -rf ~/.openclaw/skills/*/node_modules

• Confidence: 97% confidence
• Finding: This duplicate finding correctly flags the explicit destructive command rm -rf ~/.openclaw/logs/*.log. The issue is not malicious intent but unsafe documentation that encourages irreversible deletion without guardrails.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **排除大文件**：
   ```bash
   # 排除日志
   rm -rf ~/.openclaw/logs/*.log
   
   # 排除node_modules（如果有）
   rm -rf ~/.openclaw/skills/*/node_modules

• Confidence: 97% confidence
• Finding: This duplicate finding correctly flags the explicit destructive command rm -rf ~/.openclaw/logs/*.log. The issue is not malicious intent but unsafe documentation that encourages irreversible deletion without guardrails.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.openclaw/logs/*.log
   
   # 排除node_modules（如果有）
   rm -rf ~/.openclaw/skills/*/node_modules
   ```

3. **使用SSD作为临时目录**：

• Confidence: 96% confidence
• Finding: This duplicate finding correctly flags the recursive wildcard deletion of node_modules directories. The command can break skills and, if edited incorrectly, expand the deletion scope unexpectedly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.openclaw/logs/*.log
   
   # 排除node_modules（如果有）
   rm -rf ~/.openclaw/skills/*/node_modules
   ```

3. **使用SSD作为临时目录**：

• Confidence: 96% confidence
• Finding: This duplicate finding correctly flags the recursive wildcard deletion of node_modules directories. The command can break skills and, if edited incorrectly, expand the deletion scope unexpectedly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**清理**：
```bash
# 删除未完成的备份
rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp
rm -rf /tmp/openclaw_backup_*
```

• Confidence: 89% confidence
• Finding: rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp forcibly removes matching incomplete backup files. The path is relatively specific, but the command is still irreversible and lacks an adjacent caution about permanent deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# 删除未完成的备份
rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp
rm -rf /tmp/openclaw_backup_*
```

**重新备份**：

• Confidence: 90% confidence
• Finding: This duplicate finding flags recursive deletion of temporary backup directories under /tmp. The context lowers severity because it is cleanup of temp artifacts, but it remains destructive shell guidance.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# 删除未完成的备份
rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp
rm -rf /tmp/openclaw_backup_*
```

**重新备份**：

• Confidence: 90% confidence
• Finding: This duplicate finding flags recursive deletion of temporary backup directories under /tmp. The context lowers severity because it is cleanup of temp artifacts, but it remains destructive shell guidance.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: FAQ.md:256