Openclaw Restore

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This restore skill has a clear purpose, but it can replace persistent OpenClaw state and credentials from weakly validated backups and then restart OpenClaw, so users should review it carefully before installing.

Install only if you understand that restoring a backup can replace your OpenClaw memory, configuration, sessions, credentials, and skills. Use backups from a trusted source, avoid running the curl-to-bash disaster-recovery command, prefer pinned official installers, do not store backup passwords in shell environment variables, and inspect archive contents before restoring.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:151
• Finding: Mutable Remote Homebrew Installer Is Downloaded and Executed Directly## Vulnerability Details **File Location**: `README.md:151` and `FAQ.md:207` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` ### Technical Analysis The disaster-recovery documentation retrieves a shell script from the mutable `HEAD` branch of an external repository and immediately executes the response with Bash. There is no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded payload before execution. Although the URL is associated with Homebrew's GitHub organization, the command's effective behavior can change after this Skill has been reviewed. A compromise of the upstream repository, maintainer account, delivery infrastructure, or installation branch would turn this documented command into an arbitrary remote-code execution channel. Installing Homebrew is ancillary to restoring OpenClaw backups and exceeds the minimum functionality required by the restoration scripts. The Skill itself only requires existing local tools such as Bash, `tar`, `shasum`, and OpenSSL. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the content-delivery path. 2. The attacker modifies `install.sh` on the mutable `HEAD` branch. 3. A user follows the Skill's macOS disaster-recovery instructions. 4. `curl` downloads the attacker's current payload. 5. Bash executes the response immediately without integrity or authenticity verification. 6. The payload performs arbitrary actions with the user's privileges and could request elevated privileges through the installation flow. ### Impact Assessment The downloaded script receives arbitrary command execution as the invoking user. It can read or modify OpenClaw configuration, API credentials, restored memories, installed Skills, shell co ...[truncated 171 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl`-to-Bash command and link users to Homebrew's official installation documentation. - If automated installation is essential, pin the installer to a reviewed immutable commit rather than `HEAD`. - Download the installer as a separate file, verify an independently obtained cryptographic digest or signature, and only then execute it. - Display the installer source and require explicit user review before execution. - Document the minimum required local dependencies and allow users to install them through an already trusted package manager.

T02 · Agent Memory Poisoning

Error

• Location: scripts/restore.sh:17
• Finding: Unauthenticated Backup Archives Can Replace Persistent OpenClaw State## Vulnerability Details **File Location**: `scripts/restore.sh:17-70` and `scripts/restore_encrypted.sh:19-87` **Vulnerability Type**: Untrusted archive restoration and persistent state poisoning **Risk Level**: High ### Vulnerable Code ```bash if [ -f "$ARCHIVE.sha256" ]; then echo "🔐 验证备份完整性..." if ! shasum -c "$ARCHIVE.sha256"; then echo "❌ 校验失败！备份文件可能已损坏。" echo "是否仍要继续？[y/N]" read -p "> " CONFIRM if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then exit 1 fi fi echo "✓ 校验通过" fi mkdir -p "$RESTORE_TMP" echo "📦 解压备份文件..." tar -xzf "$ARCHIVE" -C "$RESTORE_TMP" if [ -d "$HOME/.openclaw" ]; then BACKUP_OLD="$HOME/.openclaw.backup.$(date +"%Y%m%d_%H%M%S")" mv "$HOME/.openclaw" "$BACKUP_OLD" fi if [ -d "$RESTORE_TMP/.openclaw" ]; then cp -a "$RESTORE_TMP/.openclaw" "$HOME/" fi if [ -d "$RESTORE_TMP/.clawdbot" ]; then cp -a "$RESTORE_TMP/.clawdbot" "$HOME/" fi if command -v openclaw >/dev/null 2>&1; then openclaw doctor || true openclaw gateway restart || true fi ``` The encrypted restoration path applies the same extraction and replacement behavior: ```bash if [ -f "$ENCRYPTED_ARCHIVE.sha256" ]; then if ! shasum -c "$ENCRYPTED_ARCHIVE.sha256"; then exit 1 fi fi tar -xzf "$DECRYPTED_ARCHIVE" -C "$RESTORE_TMP" if [ -d "$RESTORE_TMP/.openclaw" ]; then cp -a "$RESTORE_TMP/.openclaw" "$HOME/" fi if [ -d "$RESTORE_TMP/.clawdbot" ]; then cp -a "$RESTORE_TMP/.clawdbot" "$HOME/" fi openclaw gateway restart || true ``` ### Technical Analysis SHA-256 sidecar verification is optional. In the unencrypted restoration script, users can proceed even after verification fails. More importantly, an ordinary checksum only detects accidental changes; it does not authenticate who created the archive because an attacker can replace both an arch ...[truncated 2015 chars]
• Remediation: ## Remediation Suggestions - Require cryptographic authenticity, not only integrity. Verify a digital signature from a trusted public key or an HMAC generated with a protected backup key. - Reject missing or failed authentication by default; do not permit interactive bypass for failed verification. - List and validate all archive members before extraction. - Reject absolute paths, parent-directory components, device nodes, FIFOs, hard links, and symbolic links that resolve outside the restoration root. - Restore only an explicit allowlist of expected OpenClaw files and directories. - Extract and inspect restored memory, configuration, and Skills in quarantine before replacing current state. - Do not restart the gateway automatically after restoring untrusted content. Require a separate confirmation after validation. - Preserve the rollback directory until the restored instance has been explicitly verified.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/restore_encrypted.sh:12
• Finding: Predictable Shared Temporary Directories Permit Local Tampering## Vulnerability Details **File Location**: `scripts/restore_encrypted.sh:12-52` and `scripts/restore.sh:12-35` **Vulnerability Type**: Insecure temporary-file creation **Risk Level**: Medium ### Vulnerable Code ```bash RESTORE_TMP="/tmp/openclaw_restore_$(date +"%Y-%m-%d_%H-%M-%S")" DECRYPTED_ARCHIVE="$RESTORE_TMP/backup.tar.gz" mkdir -p "$RESTORE_TMP" if ! openssl enc -aes-256-cbc -d -pbkdf2 -iter 100000 \ -in "$ENCRYPTED_ARCHIVE" \ -out "$DECRYPTED_ARCHIVE" \ -pass pass:"$BACKUP_PASSWORD"; then rm -rf "$RESTORE_TMP" exit 1 fi tar -xzf "$DECRYPTED_ARCHIVE" -C "$RESTORE_TMP" ``` The plain restoration script uses the same predictable naming scheme: ```bash RESTORE_TMP="/tmp/openclaw_restore_$(date +"%Y-%m-%d_%H-%M-%S")" mkdir -p "$RESTORE_TMP" tar -xzf "$ARCHIVE" -C "$RESTORE_TMP" ``` ### Technical Analysis The temporary directory name is derived only from the current timestamp with one-second precision. It is therefore predictable, and `mkdir -p` accepts a path that already exists instead of requiring exclusive creation. On a multi-user system, a local attacker can pre-create the anticipated directory or populate it with attacker-controlled entries. In the encrypted flow, the decrypted archive is written to a predictable filename without first ensuring that it is a newly created regular file. The scripts also do not set a restrictive `umask`, explicitly enforce mode `0700`, verify ownership, or install an `EXIT` trap that guarantees cleanup after signals and unexpected failures. ### Attack Path 1. A local attacker observes or predicts when the victim starts restoration. 2. The attacker pre-creates the corresponding `/tmp/openclaw_restore_YYYY-MM-DD_HH-MM-SS` path. 3. The attacker places crafted files or links in that directory before `mkdir -p` runs. 4. The script accepts the existing path and writes or extracts sensitive backup data into it. 5. In the encrypted flow ...[truncated 642 chars]
• Remediation: ## Remediation Suggestions - Create an unpredictable directory atomically: ```bash umask 077 RESTORE_TMP="$(mktemp -d "${TMPDIR:-/tmp}/openclaw_restore.XXXXXX")" ``` - Verify that the resulting path is a directory owned by the current effective user. - Install cleanup immediately after creation: ```bash cleanup() { rm -rf -- "$RESTORE_TMP" } trap cleanup EXIT HUP INT TERM ``` - Create sensitive output files using exclusive, restrictive creation and reject symbolic links. - Keep decrypted content in a user-private location with directory mode `0700` and file mode `0600`. - Do not use `mkdir -p` for a security-sensitive temporary workspace.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/restore_encrypted.sh:30
• Finding: Backup Password Is Exposed Through Process Arguments and Environment Variables## Vulnerability Details **File Location**: `scripts/restore_encrypted.sh:30-43` and `README.md:205-211` **Vulnerability Type**: Sensitive information exposure **Risk Level**: Medium ### Vulnerable Code ```bash if [ -z "${OPENCLAW_BACKUP_PASSWORD:-}" ]; then echo "请输入备份密码:" read -s BACKUP_PASSWORD echo "" else BACKUP_PASSWORD="$OPENCLAW_BACKUP_PASSWORD" fi if ! openssl enc -aes-256-cbc -d -pbkdf2 -iter 100000 \ -in "$ENCRYPTED_ARCHIVE" \ -out "$DECRYPTED_ARCHIVE" \ -pass pass:"$BACKUP_PASSWORD"; then rm -rf "$RESTORE_TMP" exit 1 fi ``` The README also recommends a plaintext environment variable: ```bash export OPENCLAW_BACKUP_PASSWORD="your_password" ``` ### Technical Analysis The OpenSSL `-pass pass:` form embeds the password directly in the process argument vector. Depending on the operating system and process-inspection controls, command-line arguments may be visible to other local users, monitoring agents, diagnostic tools, crash collectors, or process-history systems while OpenSSL is running. The alternative environment-variable workflow also keeps the password in process environments and may encourage users to save it in shell profiles or automation files. `read -s` protects terminal echo but does not mitigate exposure once the value is inserted into OpenSSL's command line. ### Attack Path 1. The victim starts restoration of a sufficiently large encrypted backup. 2. The script launches OpenSSL with the password embedded in its arguments. 3. A local process observer or monitoring system captures the OpenSSL command line or inherited environment. 4. The observer extracts the backup password. 5. The attacker obtains a copy of the encrypted backup and decrypts its OpenClaw data. ### Impact Assessment Exposure of the password compromises the confidentiality of every backup encrypted with the same password. The decrypted material may include API ...[truncated 233 chars]
• Remediation: ## Remediation Suggestions - Do not use `-pass pass:` for secrets. - Pass the password through an inherited protected file descriptor, such as OpenSSL's `-pass fd:N` mechanism. - Alternatively, use a mode-`0600` temporary password file in a mode-`0700` temporary directory and securely remove it immediately after use. - Avoid documenting a persistent plaintext password environment variable. - Recommend a system credential store or interactive secret provider for automation. - Clear the shell variable after decryption: ```bash unset BACKUP_PASSWORD OPENCLAW_BACKUP_PASSWORD ``` - Document that backup passwords should be unique and rotated if local process exposure is suspected.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:255
• Finding: Recursive World-Readable Permissions Expose Private OpenClaw Data## Vulnerability Details **File Location**: `README.md:255-256`, `FAQ.md:341-342`, and `SKILL.md:476-477` **Vulnerability Type**: Overly permissive filesystem permissions **Risk Level**: Medium ### Vulnerable Code ```bash chmod -R 755 ~/.openclaw chmod 600 ~/.openclaw/config.yaml ``` ### Technical Analysis Recursive mode `755` gives every local user read and traversal access to all files and directories under `~/.openclaw`. Only `config.yaml` is subsequently returned to mode `600`. Other files can include memories, logs, workspace content, channel sessions, cached credentials, private Skill data, and API-related material. Files generally do not need execute permission, and private application data does not need to be readable by other users. The command therefore exceeds least privilege and can expose restored secrets while attempting to solve an unrelated permissions problem. ### Attack Path 1. A user encounters a restoration-related permission error. 2. The user follows the documented troubleshooting command. 3. Every file below `~/.openclaw` becomes readable by other local accounts. 4. Another local user or service enumerates the directory and reads sensitive files not covered by the subsequent `chmod 600` command. 5. Extracted tokens or private data are used for account access or information disclosure. ### Impact Assessment Any local account with filesystem access can potentially read sensitive OpenClaw data. The exposed scope may include Agent memories, conversation data, logs, bot tokens, channel state, API credentials stored outside `config.yaml`, and private Skill configuration. The command does not itself grant write access to other users, but disclosure of credentials may enable access to external systems.
• Remediation: ## Remediation Suggestions - Remove the recursive `chmod 755` recommendation. - Set private directories to mode `700` and sensitive regular files to mode `600`. - Grant execute permission only to files that are genuinely executable. - Use type-specific commands where repair is required: ```bash find "$HOME/.openclaw" -type d -exec chmod 700 {} + find "$HOME/.openclaw" -type f -exec chmod 600 {} + ``` - Restore executable permission only on reviewed scripts that require it. - Verify ownership before changing permissions and avoid running recursive permission changes with elevated privileges. - Document platform-specific OpenClaw permission requirements instead of applying broad generic modes.

T08 · Insecure Dependencies

Warning

• Location: README.md:157
• Finding: Unpinned Global OpenClaw Package Installation Creates Supply-Chain Exposure## Vulnerability Details **File Location**: `README.md:157`, `FAQ.md:213,298`, and `SKILL.md:407` **Vulnerability Type**: Unpinned global dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g openclaw ``` ### Technical Analysis The disaster-recovery instructions install the latest package currently associated with the `openclaw` registry name. No package version, integrity hash, lockfile, signature, or trusted release artifact is specified. NPM installation may execute package lifecycle scripts, making installation an immediate code-execution boundary. Global installation also modifies user-wide or system-wide tooling rather than using a project-contained dependency. The command is relevant to rebuilding an OpenClaw installation, but its unpinned form exposes the recovery process to unexpected upstream releases, registry account compromise, and package supply-chain incidents. ### Attack Path 1. An attacker compromises the package publisher account, registry entry, or a transitive dependency used by the latest release. 2. A malicious package version or lifecycle script is published. 3. A user follows the disaster-recovery documentation. 4. NPM resolves the unpinned name to the malicious current version. 5. Installation or lifecycle scripts execute with the privileges used for global installation. 6. The malicious package modifies OpenClaw state, user files, or globally installed tooling. ### Impact Assessment A compromised package can execute arbitrary code as the account performing installation. If the package manager is run with administrative privileges due to global-installation permissions, the effect may extend to system-wide files and tools. Otherwise, the likely scope includes user files, restored OpenClaw credentials and memories, shell configuration, and user-global NPM packages.
• Remediation: ## Remediation Suggestions - Pin OpenClaw to a reviewed, known-good version: ```bash npm install -g openclaw@REVIEWED_VERSION ``` - Verify the package's registry provenance, integrity metadata, and official publisher before installation. - Prefer an official signed release or a package-manager lockfile that records exact dependency versions and integrity values. - Avoid administrative execution and configure a user-owned NPM prefix if global installation is required. - Consider disabling lifecycle scripts during initial retrieval and explicitly reviewing any required scripts before running them. - Document a tested OpenClaw version compatible with the backup format rather than automatically selecting the newest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Restore Skill

🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

确认恢复成功后可删除：
```bash
rm -rf ~/.openclaw.backup.20260313_204600
```

### 完整性验证

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

确认恢复成功后可删除：
```bash
rm -rf ~/.openclaw.backup.20260313_204600
```

### 完整性验证

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: openclaw-restore
slug: halaoluan-openclaw-restore
version: 1.0.0
description: 一键恢复 OpenClaw 数据（支持加密/未加密备份）。Use when user asks to restore OpenClaw, recover data, restore from backup, or fix broken installation. Triggers: "恢复", "restore", "recover", "恢复备份", "还原数据", "restore backup".
---

# OpenClaw 恢复 Skill

从备份文件一键恢复 OpenClaw 数据，支持加密和未加密备份。

---

## 使用场景

| 触发词 | 操作 |
|--------|------|
| "恢复 OpenClaw" | 从备份恢复数据 |
| "恢复最新备份" | 自动选择最新备份恢复 |
| "恢复加密备份" | 解密并恢复 |
| "列

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Ae1

High

• Category: analysis-evasion

Content

位置：`scripts/restore.sh`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

位置：`scripts/restore.sh`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo ""
if [ -n "${BACKUP_OLD:-}" ]; then
    echo "旧数据已备份到: $BACKUP_OLD"
    echo "确认恢复成功后可删除: rm -rf $BACKUP_OLD"
fi
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo ""
if [ -n "${BACKUP_OLD:-}" ]; then
    echo "旧数据已备份到: $BACKUP_OLD"
    echo "确认恢复成功后可删除: rm -rf $BACKUP_OLD"
fi
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

• Category: analysis-evasion

Content

位置：`scripts/restore_encrypted.sh`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

位置：`scripts/restore_encrypted.sh`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s user-facing instructions and descriptions are presented only in Chinese, and there is no indication that the skill is intended exclusively for a Chinese-speaking audience or that alternate language support is available. This can violate language/locale policy when users are not given an opt-in or choice of language.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This markdown file uses Chinese throughout, including headings, instructions, and troubleshooting steps, and does not provide any indication that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a single language without user opt-in is a natural-language policy concern.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

**诊断**：
```bash
ls -la ~/.openclaw/skills/
openclaw skills list
```

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

**诊断**：
```bash
ls -la ~/.openclaw/skills/
openclaw skills list
```

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The skill description begins in Chinese and the rest of the README continues entirely in Chinese, with no indication that other languages are supported or that the locale is intentionally constrained. Under the policy for natural-language violations, this is a language-choice issue because users are not given an opt-in or alternative.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**解决**：
```bash
chmod -R 755 ~/.openclaw
chmod 600 ~/.openclaw/config.yaml
```

---

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**解决**：
```bash
chmod -R 755 ~/.openclaw
chmod 600 ~/.openclaw/config.yaml
```

---

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**解决**：
```bash
chmod -R 755 ~/.openclaw
chmod 600 ~/.openclaw/config.yaml
```

---

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The Chinese activation phrases are similarly broad and can match routine troubleshooting or recovery discussions rather than a deliberate request to execute a restore operation. Because the skill performs destructive actions, ambiguous invocation language materially raises the risk of accidental execution.

Static analysis

No suspicious patterns detected.