Openclaw Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This backup skill matches its stated purpose, but its scripts and guidance handle sensitive OpenClaw data unsafely enough that users should review it before installing.

Treat this as a Review install. Only use it after hardening the scripts: create private random temp directories, keep plaintext archives inside protected temp storage with cleanup traps, avoid passing backup passwords through command-line arguments or long-lived environment variables, validate and show cron entries before installing them, and do not follow the documented chmod -R 755 or live-directory deletion examples.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_encrypted.sh:8

Finding

Predictable and Insufficiently Protected Temporary Backup Storage

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_encrypted.sh:70

Finding

Backup Password Exposed Through OpenSSL Process Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_cron.sh:6

Finding

Persistent Cron Command Injection Through Unvalidated Schedule and Script Values

Content

View full analysis

" CRON_EXPR DESC="自定义: $CRON_EXPR" ;; esac if crontab -l 2>/dev/null | grep -q "openclaw.*backup"; then echo "" echo "⚠️ 发现已有 OpenClaw 备份任务，是否覆盖？[y/N]" read -p "> " CONFIRM if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then echo "取消操作" exit 0 fi crontab -l 2>/dev/null | grep -v "openclaw.*backup" | crontab - fi (crontab -l 2>/dev/null; echo "$CRON_EXPR $BACKUP_SCRIPT >> /tmp/openclaw_backup.log 2>&1") | crontab - ``` The same implementation is embedded in `SKILL.md:232-283`. ### Technical Analysis The custom `CRON_EXPR` is read from user input and inserted verbatim into the user's crontab. `OPENCLAW_BACKUP_SCRIPT` is likewise accepted from the environment without validation or safe serialization. The script does not reject newlines, control characters, additional cron fields, shell metacharacters, or inline commands. A crafted value can therefore introduce an additional crontab line or change the command that cron executes. Because the generated entry is installed through `crontab -`, the injected command persists across shell sessions and runs with the privileges of the affected user. The existing-entry detection and removal expression, `openclaw.*backup`, is also overly broad. It can match and remove unrelated user cron entries containing those words. The persistence mechanism itself is directly related to the declared automatic-backup feature and remains user-level. The vulnerability is the unvalidated construction and broad modifica ...[truncated 1030 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_encrypted.sh:63

Finding

Failure Paths Leave Plaintext Backups Behind and May Keep the Gateway Stopped

Content

View full analysis

/dev/null 2>&1; then echo "⏸ 停止网关..." openclaw gateway stop 2>/dev/null || true sleep 2 fi echo "📦 打包中..." tar -czf "/tmp/$ARCHIVE_NAME" -C "$TMP_DIR" . echo "🔐 加密中..." openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \ -in "/tmp/$ARCHIVE_NAME" \ -out "$BACKUP_ROOT/$ENCRYPTED_NAME" \ -pass pass:"$BACKUP_PASSWORD" shasum -a 256 "$BACKUP_ROOT/$ENCRYPTED_NAME" > "$BACKUP_ROOT/$ENCRYPTED_NAME.sha256" rm -f "/tmp/$ARCHIVE_NAME" rm -rf "$TMP_DIR" if command -v openclaw >/dev/null 2>&1; then echo "▶️ 重启网关..." openclaw gateway start 2>/dev/null || true fi ``` ### Technical Analysis The script uses `set -e`, so an error in archive creation, encryption, checksum generation, or cleanup terminates execution immediately. Cleanup and gateway restart are performed only on the normal success path. No `EXIT`, `INT`, `TERM`, or `HUP` trap ensures restoration. Once `tar` succeeds, a plaintext compressed archive containing the complete OpenClaw state exists directly under `/tmp`. If OpenSSL or a later command fails, that archive remains on disk. If the gateway was successfully stopped, the same failure can prevent it from being restarted. The script also ignores the result of `openclaw gateway stop`, making it impossible to accurately track whether this invocation changed service state. ### Attack Path 1. The victim starts an encrypted backup. 2. The script stops the OpenClaw gateway and creates a plaintext archive. 3. Encryption or checksum generation is made to fail, for example through exhausted disk space, destination permission errors, a missing OpenSSL binary, process termination, or another runtime fault. 4. `set -e` terminates the script before c ...[truncated 603 chars]

Remediation

View remediation

/dev/null 2>&1 || true fi exit "$status" } trap cleanup EXIT HUP INT TERM ``` Further measures: - Store the plaintext archive inside a mode-`0700` random temporary directory. - Set `GATEWAY_STOPPED=1` only after a confirmed successful stop. - Write encrypted output to a temporary destination and atomically rename it after successful encryption. - Remove partial encrypted output when encryption fails. - Consider avoiding gateway shutdown unless required for consistency and explicitly requested. - Apply the same lifecycle controls to the unencrypted script where service restoration is relevant. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: ADVANCED.md:27

Finding

Documented Exclusion Procedure Deletes Live OpenClaw Data

Content

View full analysis

/dev/null || true # 排除 node_modules（如果存在） find "$STATE_DIR_NEW" -name "node_modules" -type d -exec rm -rf {} + 2>/dev/null || true # 排除临时文件 find "$STATE_DIR_NEW" -name "*.tmp" -delete 2>/dev/null || true ``` ``` Equivalent destructive guidance appears in `SKILL.md:497-504`. ### Technical Analysis The documentation presents these commands as backup exclusions and instructs users to place them before the source directory is copied. However, each command operates directly on `STATE_DIR_NEW`, which points to the live `~/.openclaw` directory. Consequently, the commands do not merely omit files from an archive. They recursively delete matching data from the active application state. The `|| true` suffix suppresses errors and makes partial deletion less visible. Deleting logs can destroy diagnostic or forensic evidence. Deleting dependency directories can break installed skills or application components. Broad `*.tmp` deletion may remove files that are still required by running processes. ### Attack Path 1. A user experiences a large backup and follows the documented optimization procedure. 2. The user inserts the recommended commands before `cp -a`. 3. The next backup runs the `find` commands against the live OpenClaw state. 4. Logs, temporary files, and every matching `node_modules` directory are recursively deleted. 5. The user may discover the damage only after application failures or when data is needed for troubleshooting. ### Impact Assessment The commands execute with the user's privileges and can delete any matching object reachable under the user's OpenClaw state directory. Impact includes permanent user-data loss, destroyed forensic records, broken ...[truncated 125 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: FAQ.md:337

Finding

Recursive World-Readable Permission Recommendation Exposes Sensitive State

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (78)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ADVANCED.md (reported line 308)May include surrounding context.

du -sh "$STATE_DIR_NEW"/* | sort -hr | head -10

根据输出，排除大文件

rm -rf "$TMP_DIR/.openclaw/logs" rm -rf "$TMP_DIR/.openclaw/.npm"

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ADVANCED.md (reported line 309)May include surrounding context.

根据输出，排除大文件

rm -rf "$TMP_DIR/.openclaw/logs" rm -rf "$TMP_DIR/.openclaw/.npm"

text

### 3. 分片备份（大文件）

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

The cleanup pipeline uses 'ls | tail | xargs rm -f', which is unsafe for filenames containing whitespace, newlines, or leading hyphens and may delete unintended files. In a backup directory containing unusual or attacker-planted filenames, this can cause accidental data loss or broaden the deletion scope.

Content

Scanner excerpt · ADVANCED.md (reported line 393)May include surrounding context.

bash

# 清理旧备份（保留最近5个）
cd ~/Desktop/OpenClaw_Backups
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f

问题3：cron任务失败

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · ADVANCED.md (reported line 404)May include surrounding context.

�2：磁盘空间不足

诊断：

bash

df -h
du -sh ~/.openclaw

解决：

bash

# 清理旧备份（保留最近5个）
cd ~/Desktop/OpenClaw_Backups
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f

问题3：cron任务失败

诊断：

bash

# 查看cron日志
tail -f /tmp/openclaw_backup.log

# 手动测试cron环境
env -i HOME=$HOME /bin/bash -c 'crontab -l | grep openclaw'

解决：

• 使用绝对路径
• 设置 PATH 环境变量
• 检查权限

---

📊 备份策略对比

策略	优点	缺点	适用场景
完整备份	简单、快速恢复	占用空间大	每周/月备份
增量备份	节省空间	恢复复杂	每日备份
最小备份	速度快、空间小	不完整	紧急备份
3-2-1备份	最安全	管理复杂	生产环境

---

🔗 相关资源

• OpenClaw官方文档
• [备份最佳实

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The pipeline ls -t ... | tail -n +6 | xargs rm -f chains file selection directly into deletion, which is error-prone and offers no confirmation. Filenames with unusual characters and unexpected glob matches can lead to accidental removal of backups beyond what the user intended.

Content

Scanner excerpt · FAQ.md (reported line 166)May include surrounding context.

md

rm openclaw_backup_2026-03-01_*.tar.gz*

# 方式2：只保留最近5个
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f
ls -t openclaw_backup_*.tar.gz.enc.sha256 | tail -n +6 | xargs rm -f

# 方式3：删除30天前的备份

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This second chained deletion command removes checksum files using the same unsafe pattern. In a backup context, deleting integrity metadata can silently reduce the ability to verify archive correctness and impede recovery confidence.

Content

Scanner excerpt · FAQ.md (reported line 167)May include surrounding context.

md

# 方式2：只保留最近5个
ls -t openclaw_backup_*.tar.gz.enc | tail -n +6 | xargs rm -f
ls -t openclaw_backup_*.tar.gz.enc.sha256 | tail -n +6 | xargs rm -f

# 方式3：删除30天前的备份
find . -name "openclaw_backup_*.tar.gz*" -mtime +30 -delete

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding correctly flags the explicit destructive command rm -rf ~/.openclaw/logs/*.log. The issue is not malicious intent but unsafe documentation that encourages irreversible deletion without guardrails.

Content

Scanner excerpt · FAQ.md (reported line 256)May include surrounding context.

2. 排除大文件：

   bash

   # 排除日志
   rm -rf ~/.openclaw/logs/*.log
   
   # 排除node_modules（如果有）
   rm -rf ~/.openclaw/skills/*/node_modules
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding correctly flags the explicit destructive command rm -rf ~/.openclaw/logs/*.log. The issue is not malicious intent but unsafe documentation that encourages irreversible deletion without guardrails.

Content

Scanner excerpt · FAQ.md (reported line 256)May include surrounding context.

2. 排除大文件：

   bash

   # 排除日志
   rm -rf ~/.openclaw/logs/*.log
   
   # 排除node_modules（如果有）
   rm -rf ~/.openclaw/skills/*/node_modules
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This duplicate finding correctly flags the recursive wildcard deletion of node_modules directories. The command can break skills and, if edited incorrectly, expand the deletion scope unexpectedly.

Content

Scanner excerpt · FAQ.md (reported line 259)May include surrounding context.

rm -rf ~/.openclaw/logs/*.log

排除node_modules（如果有）

rm -rf ~/.openclaw/skills/*/node_modules

text

3. **使用SSD作为临时目录**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This duplicate finding correctly flags the recursive wildcard deletion of node_modules directories. The command can break skills and, if edited incorrectly, expand the deletion scope unexpectedly.

Content

Scanner excerpt · FAQ.md (reported line 259)May include surrounding context.

rm -rf ~/.openclaw/logs/*.log

排除node_modules（如果有）

rm -rf ~/.openclaw/skills/*/node_modules

text

3. **使用SSD作为临时目录**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp forcibly removes matching incomplete backup files. The path is relatively specific, but the command is still irreversible and lacks an adjacent caution about permanent deletion.

Content

Scanner excerpt · FAQ.md (reported line 396)May include surrounding context.

清理：

bash

# 删除未完成的备份
rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp
rm -rf /tmp/openclaw_backup_*

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This duplicate finding flags recursive deletion of temporary backup directories under /tmp. The context lowers severity because it is cleanup of temp artifacts, but it remains destructive shell guidance.

Content

Scanner excerpt · FAQ.md (reported line 397)May include surrounding context.

bash

# 删除未完成的备份
rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp
rm -rf /tmp/openclaw_backup_*

重新备份：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This duplicate finding flags recursive deletion of temporary backup directories under /tmp. The context lowers severity because it is cleanup of temp artifacts, but it remains destructive shell guidance.

Content

Scanner excerpt · FAQ.md (reported line 397)May include surrounding context.

bash

# 删除未完成的备份
rm -f ~/Desktop/OpenClaw_Backups/openclaw_backup_*.tar.gz.tmp
rm -rf /tmp/openclaw_backup_*

重新备份：

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ADVANCED.md (reported line 77)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ADVANCED.md (reported line 134)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · CLAWHUB.md (reported line 15)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · DEMO.md (reported line 13)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · DEMO.md (reported line 40)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · DEMO.md (reported line 65)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

md

# OpenClaw Backup Skill

🐈‍⬛ **定期备份 OpenClaw 数据，支持加密、定时、云同步**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)