T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/cli.js:87- Finding
Immediate backup command silently forces a full backup of sensitive OpenClaw data
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw自动备份工具_auto-backup-openclaw-user-data
Security checks for vulnerabilities and agentic risk
Overview
This backup skill is not clearly malicious, but it needs Review because it can back up more data than users may expect and mishandles some sensitive backup settings.
Install only if you are comfortable reviewing and tightening the configuration first: avoid full backups unless intended, enable sensitive-file exclusions and encryption, keep backups in a private dedicated directory, do not store Telegram tokens in copied prompts, and do not pass custom backup targets containing paths like .. or absolute paths.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/backup.js:148- Finding
Traversal-capable backup targets permit reads outside the OpenClaw directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cleaner.js:84- Finding
Retention cleanup can delete unrelated ZIP archives from configurable directories
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cli.js:1122- Finding
ZIP encryption passwords are weakly generated, echoed, and stored in plaintext
- Content
View full analysis
= 8) { // 用户自定义密码 output.push('密码已设置：' + input); ``` Password generation uses `Math.random()`: ```js // scripts/cli.js:1122-1129 generateRandomPassword() { const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789#$@%&'; let password = ''; for (let i = 0; i < 16; i++) { password += chars.charAt(Math.floor(Math.random() * chars.length)); } return password; } ``` The password is assigned to the normal configuration object: ```js // scripts/cli.js:1280-1290 // 确保output.encryption配置结构存在 if (!config.output.encryption) { config.output.encryption = { enabled: false, password: null, algorithm: "aes-256", reminderShown: false }; } config.output.encryption.password = state.encryptionPassword; ``` The configuration is then written as ordinary JSON without an explicit restrictive mode: ```js // scripts/config.js:187-200 async function saveConfig(config) { try { await ensureConfigDir(); config.updatedAt = new Date().toISOString(); // 验证配置 const validation = validateConfig(config); if (!validation.valid) { throw new Error(`配置验证失败: ${validation.errors.join(', ')}`); } await fs.writeJson(CONFIG_FILE, config, { spaces: 2 }); ``` ### Technical Analysis `Math.random()` is not a cryptographically secure pseudorandom number generator and should not be use ...[truncated 1663 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (82)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The same section documents that secret-bearing files such as secrets.json are not forcibly excluded from backups. Given this skill's purpose is automated archival of user data, retaining secrets by default expands the blast radius of any compromise of backup storage or transfer channels.
- Content
md - **密钥文件**：*.key, *.pem, *.p12, *.pfx - **环境变量**：.env, .env.local, .env.*.local - **凭证文件**：credentials.json, secrets.json - **Token文件**：*.token, *.secret, *_token.json - **SSH密钥**：id_rsa, id_dsa, *.ppk
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The same section documents that secret-bearing files such as secrets.json are not forcibly excluded from backups. Given this skill's purpose is automated archival of user data, retaining secrets by default expands the blast radius of any compromise of backup storage or transfer channels.
- Content
md - **密钥文件**：*.key, *.pem, *.p12, *.pfx - **环境变量**：.env, .env.local, .env.*.local - **凭证文件**：credentials.json, secrets.json - **Token文件**：*.token, *.secret, *_token.json - **SSH密钥**：id_rsa, id_dsa, *.ppk
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
{ "backup": { "exclude": ["logs", "cache", ".key", ".ssh"], "excludePatterns": [".pem", ".env", "credentials.json"] } }
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
{ "backup": { "exclude": ["logs", "cache", ".key", ".ssh"], "excludePatterns": [".pem", ".env", "credentials.json"] } }
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
{ "backup": { "exclude": ["logs", "cache", ".key", ".ssh"], "excludePatterns": [".pem", ".env", "credentials.json"] } }
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js { "backup": { "exclude": ["logs", "cache", "*.key", ".ssh"], "excludePatterns": ["*.pem", ".env", "credentials.json"] } } ```
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template instructs use of curl to call Telegram's external API directly from a backup workflow, introducing network egress and secret-handling behavior unrelated to core backup creation. Direct shell-based API calls also increase the chance of token leakage in process lists, logs, copied configs, or prompt history while sending operational details off-host.
- Content
Known Vulnerable Dependency: brace-expansion==1.1.13 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The lockfile includes brace-expansion 1.1.13, which is flagged for denial-of-service issues involving pathological brace patterns that can trigger excessive CPU or memory consumption. In this file it is a transitive dependency under minimatch/glob, so exploitation would depend on the application passing attacker-controlled glob or brace patterns into that dependency chain, but the presence of the vulnerable package is real and should be treated as a supply-chain risk.
- Content
Known Vulnerable Dependency: brace-expansion==2.0.3 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The lockfile also includes brace-expansion 2.0.3, which is likewise reported as vulnerable to resource-exhaustion DoS from crafted expansion input. Because this package is used transitively by readdir-glob/minimatch, risk is greatest if backup include/exclude selections or file-matching expressions can be influenced by users or untrusted configuration, potentially letting an attacker crash or stall backup jobs.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md *.pem # PEM证书文件 *.p12 # PKCS#12证书 *.pfx # PFX证书 .env # 环境变量文件 .env.local # 本地环境变量 .env.*.local # 环境变量文件变体 credentials.json # 凭证文件
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md *.p12 # PKCS#12证书 *.pfx # PFX证书 .env # 环境变量文件 .env.local # 本地环境变量 .env.*.local # 环境变量文件变体 credentials.json # 凭证文件 secrets.json # 密钥文件
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md "excludePatterns": [ "*.log", "*.tmp", ".DS_Store", "Thumbs.db", "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", "credentials.json", "secrets.json" ], "exclude": ["logs", "cache", "tmp", "node_modules", ".ssh", ".gnupg"] }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md "excludePatterns": [ "*.log", "*.tmp", ".DS_Store", "Thumbs.db", "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", "credentials.json", "secrets.json" ], "exclude": ["logs", "cache", "tmp", "node_modules", ".ssh", ".gnupg"] }
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The configuration display path prints the full JSON config verbatim, and later flows also include plaintext password material. Since this skill manages backup settings and encryption secrets, dumping the full config can expose stored passwords, notification targets, paths, and other sensitive data to chat transcripts, logs, or unauthorized viewers.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Displaying the randomly generated backup password directly in normal CLI/chat output exposes the very secret intended to protect the archive. In this skill context, where outputs may be retained or relayed, plaintext disclosure materially increases the chance of credential compromise and backup disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Echoing a user-entered encryption password back verbatim leaks the secret into the output channel and any associated logging or transcript systems. This undermines confidentiality of encrypted backups and can expose sensitive archived user data if the archive is later accessed by an attacker with the leaked password.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The code identifies .env.local as sensitive but does not exclude it unless the user manually enables the feature. Because this skill performs automated backups, local environment files may be silently archived on a schedule, increasing the chance of credential leakage through stored ZIPs or downstream handling.
- Content
js // 敏感文件排除建议列表（默认不启用，仅建议） sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The code identifies .env.local as sensitive but does not exclude it unless the user manually enables the feature. Because this skill performs automated backups, local environment files may be silently archived on a schedule, increasing the chance of credential leakage through stored ZIPs or downstream handling.
- Content
js // 敏感文件排除建议列表（默认不启用，仅建议） sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"