T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.py:20- Finding
Unencrypted backup archive contains sensitive Agent state
- Content
View full analysis
- Remediation
View remediation
Security audit
claw-backup
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed OpenClaw backup and restore tool, but it deserves review because it bundles sensitive workspace state into a plaintext archive and has restore/archive handling weaknesses.
Install only if you are comfortable creating a portable, unencrypted copy of sensitive OpenClaw memory, identity, user, tool, and skill files. Store backups in a private location, encrypt them yourself, avoid restoring ZIP files from untrusted sources, and review workspaces for symlinks before backing them up.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.py:113- Finding
Symbolic links can cause files outside the workspace to be archived
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/restore.py:50- Finding
Unbounded ZIP restoration permits memory and disk exhaustion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This is a significant description-behavior mismatch: the skill claims to perform backup with ZIP and SHA256 validation, but analysis indicates restore/overwrite behavior, desktop ZIP enumeration, and failure to generate the promised archive or checksum. For a skill operating on sensitive workspace state, hidden write/restore behavior can cause data loss, unauthorized modification, and user deception about what actions are being taken.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill manifest says the skill is for one-click backup of the OpenClaw workspace, generating a ZIP archive with SHA256 verification. This file instead restores files from a ZIP into the workspace and can overwrite existing files, which is a materially different operation from backup creation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 76% confidence
- Finding
The skill advertises file-backed behavior and references backup/restore scripts, but the manifest declares no explicit tool scope or permissions. In a backup skill that handles sensitive workspace data, missing scope declarations weakens reviewability and can allow broader file access than users or the platform expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrase '备份工作区' is broad enough to match ordinary user requests that may not specifically intend this skill. Because the skill can access and package highly sensitive files such as memory, identity, agent, and tool configuration, accidental activation could expose or manipulate confidential workspace data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases '导出配置' and '打包技能' are ambiguous and may activate the skill for requests that only concern a subset of files or a different packaging task. In this context, overbroad activation is more dangerous because the documented backup scope includes sensitive memory, identity, and tooling files, increasing the chance of unintended disclosure or destructive actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code creates a backup archive on the user's Desktop and includes numerous workspace files and directories, some of which may contain sensitive user or system data. Although the script prints status messages, it does not clearly warn the user about the privacy impact of writing a consolidated backup archive to a broadly accessible location.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings and documentation entirely in Chinese, including the top-level description and user prompts. Under the policy rule, forcing a specific language without opt-in is a locale/language policy violation unless the constraint is explicitly justified or the user is offered a choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The restore flow extracts and writes files from a ZIP archive without verifying the advertised SHA256 integrity/authenticity first. An attacker who can replace or tamper with a backup archive could cause restoration of malicious or corrupted files into the OpenClaw workspace, undermining trust in the backup process.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's docstrings, prompts, help text, and status messages are presented in Chinese only, which imposes a specific language on users without offering a choice. This matches the language/locale policy violation criteria because no opt-in or documented locale constraint is provided.
- Content