Daily Backup System

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent backup guide, but it handles highly sensitive backups and restore commands without enough safety controls.

Install only if you are comfortable maintaining sensitive full-system backups. Before using it, add encryption at rest, restrict file and log permissions, consider excluding or separately encrypting `.env` files, verify or replace the remote installer flow, extract restores into a staging directory first, and document how to rotate secrets after a restore or suspected exposure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:34

Finding

Unverified Remote Installation Script Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 34
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# On a fresh VPS
curl -fsSL https://openclaw.ai/install.sh | bash
cd / && tar xzf openclaw-full-backup-YYYY-MM-DD.tar.gz
openclaw gateway start

Technical Analysis

The restore instructions pipe a remotely downloaded script directly into bash. The effective executable payload is controlled by the content currently served from https://openclaw.ai/install.sh, rather than by code contained and reviewed within this project.

No immutable version, cryptographic signature, or expected checksum is specified. The command also gives the user no opportunity to inspect the downloaded file before execution. HTTPS protects the connection in transit but does not protect against compromise of the domain, DNS infrastructure, hosting account, release pipeline, or remote script itself.

Executing this installer is not required merely to extract the backup archive. Therefore, direct execution of mutable remote code exceeds the minimum behavior necessary for the archive restoration step.

Attack Path

1. An attacker compromises the remote website, DNS configuration, hosting environment, deployment pipeline, or install.sh source.
2. The attacker replaces or redirects the installation script with a malicious shell payload.
3. A user follows the documented disaster-recovery procedure on a fresh server.
4. curl retrieves the attacker-controlled response and pipes it directly to bash.
5. The payload executes immediately with all privileges held by the invoking user.
6. The payload may steal restored secrets, alter system files, install persistence, or compromise the OpenClaw environment before the gateway starts.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the restore pr ...[truncated 870 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash execution pattern.
2. Download the installer as a separate file so it can be inspected before execution:

   bash

   curl --fail --show-error --location \
     --output openclaw-install.sh \
     https://openclaw.ai/releases/VERSION/install.sh
   

3. Reference an immutable, explicitly pinned release rather than a mutable generic URL.
4. Publish an expected SHA-256 or stronger digest through a separately protected release channel and verify it before execution:

   bash

   echo 'EXPECTED_SHA256  openclaw-install.sh' | sha256sum --check -
   

5. Prefer cryptographic release signatures and verify them against a documented, trusted public key.
6. Review the downloaded script locally before running it.
7. Execute the installer using the least-privileged account possible. Elevate only individual operations that demonstrably require administrative access.
8. Separate application installation from backup restoration so users can restore onto an independently verified OpenClaw installation.
9. Replace extraction directly into / with validation of archive entries and extraction into a staging directory before copying approved files to their destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs backing up .env files containing API keys, which directly aggregates credentials into a portable archive. If the backup file, destination, cron output, or restore environment is compromised, attackers could recover secrets and gain access to external services or the OpenClaw environment.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Runs daily via cron and creates a compressed backup of:
- `openclaw.json` — all agent configs, bindings, channels, crons
- All agent workspaces (SOUL.md, TOOLS.md, memory/, scripts/)
- Environment files (.env with API keys)
- Custom scripts and data pipelines
- Reverse proxy config (Caddy/Nginx)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The restore guide tells users to fetch and execute a remote script via curl ... | bash, which executes network-delivered code without verification. If the hosting site, DNS, TLS trust chain, or distribution path is compromised, users restoring a backup could run attacker-controlled code as part of disaster recovery.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

# On a fresh VPS
curl -fsSL https://openclaw.ai/install.sh | bash
cd / && tar xzf openclaw-full-backup-YYYY-MM-DD.tar.gz
openclaw gateway start

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash pattern is a classic unsafe command chain because it immediately executes whatever bytes are returned by the remote endpoint. In this skill's disaster-recovery context, users are likely to run the command under time pressure on fresh systems, which makes exploitation more likely and more damaging.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

# On a fresh VPS
curl -fsSL https://openclaw.ai/install.sh | bash
cd / && tar xzf openclaw-full-backup-YYYY-MM-DD.tar.gz
openclaw gateway start

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states it backs up highly sensitive material including agent configs, workspaces, memory, scripts, and .env files with API keys, but it does not prominently warn users that credentials and sensitive data will be copied, retained, and potentially exposed through backup storage or logs. In a backup-oriented skill, this omission increases the chance of insecure handling, accidental sharing, or under-protected retention of secrets.

Content

No source excerpt is available for this finding.