OpenClaw自动备份工具_auto-backup-openclaw-user-data

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 1.1.0

Overview

This appears to be a genuine OpenClaw backup skill, but it needs Review because its defaults can archive sensitive local OpenClaw data and expose backup metadata without strong safeguards.

Install only if you are comfortable giving this skill broad local access to OpenClaw workspaces and memory. Before enabling automation, configure partial backup targets, turn on sensitive-file exclusions, use a private backup directory, review the heartbeat/cron templates, disable or restrict external notifications, and do not rely on ZIP encryption if the password is stored only in the skill's plaintext config file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 72% confidence
• Finding: The skill advertises capabilities that imply access to environment-derived data but does not declare corresponding permissions. Undeclared capability use weakens transparency and consent boundaries, making it harder for users or the platform to understand what sensitive context the skill can read during backup and notification workflows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The documented purpose understates several sensitive behaviors: reading OpenClaw configuration, discovering communication targets, handling encryption passwords, and identifying sensitive files. This mismatch reduces informed consent and can hide broader data access and exfiltration surfaces than a user would expect from a simple backup tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The cron template expands a backup task into mandatory outbound notification behavior and embeds concrete instructions to transmit backup results externally. That creates an unnecessary data-sharing path for operational metadata such as backup file paths, timestamps, and failure details, which can reveal sensitive environment information beyond the core backup function.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Including a direct shell-based curl call to Telegram gives the template built-in network egress capability that is not strictly required for scheduling backups. This increases the attack surface because any data placed into the message body, including backup paths and error strings, can be exfiltrated to an external service using user-supplied credentials.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The CLI introduces ZIP encryption and directly displays user-supplied or generated passwords in output, then persists the password in config.json. Storing backup decryption secrets alongside the protected data and echoing them back to the interface materially weakens the protection model and can expose credentials to logs, screenshots, chat transcripts, or other local readers.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The template directs the agent to perform filesystem backup operations and send outbound notifications automatically on heartbeat without an explicit safety gate, user confirmation model, or warning about data and system side effects. In an agent setting, this increases the chance of unintended recurring actions, resource usage, and disclosure of backup metadata to external channels if the template is adopted as-is.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger condition '用户要求备份 OpenClaw 数据' is broad enough that ordinary discussion about backups could invoke the skill. In a backup skill that can access user data and send notifications, overbroad activation increases the chance of unintended data processing or backup execution without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: The trigger for asking about backup configuration, status, or logs is also ambiguous and may overlap with informational conversation. Because logs and status can reveal file paths, backup targets, and operational metadata, accidental invocation may expose sensitive information beyond what the user intended to request.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The documentation mentions multi-channel notifications but does not clearly warn that backup status and related metadata may be transmitted to external services such as Feishu or Telegram. Even if file contents are not sent, operational metadata can reveal usernames, workspace names, schedule timing, filenames, or failure causes that are sensitive in aggregate.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template instructs sending backup results, including storage location information, to Feishu and Telegram without warning the user that operational data will leave the local environment. Even when the content is not the backup payload itself, exposing filesystem paths, timestamps, and failure messages can leak sensitive internal details useful to an attacker.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template asks users to configure Telegram bot tokens and chat identifiers but does not warn about secret handling, storage, or external network use. This can lead to insecure credential placement in config files, prompts, logs, or version-controlled documentation, creating avoidable token exposure risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The cleanup command executes deletion immediately via cleaner.execute() unless the caller separately chose preview mode, and the code does not enforce a confirmation gate in the destructive path. This creates a risk of accidental or coerced data deletion, especially in agent-driven or chat-triggered contexts where command intent may be ambiguous.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Success and failure notifications include sensitive operational details such as the full backup storage path and raw error content, and these are prepared for external notification channels. If those channels include third parties, shared groups, or less-trusted recipients, the messages can leak filesystem layout, usernames, workspace paths, and internal failure details that aid reconnaissance.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The documentation normalizes backing up sensitive files and pairing backups with notifications, which creates a clear path for secrets and credential-bearing material to be copied, retained, and potentially discussed or signaled externally. In the context of an automated backup skill, this increases the blast radius of any misconfiguration or compromise of backup storage or notification channels.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The security warning explicitly states that backups may include secrets and that the default behavior is not to prevent this. That is dangerous because it turns a documented edge case into an accepted default, making accidental collection and long-term retention of credentials more likely in an automated workflow.

Credential Access

High

• Category: Privilege Escalation

Content

"sensitiveExcludeSuggestion": [
      "*.key", "*.pem", "*.p12", "*.pfx",
      ".env", ".env.local", ".env.*.local",
      "credentials.json", "secrets.json",
      "*.token", "*.secret", "*_token.json",
      "id_rsa", "id_dsa", "*.ppk"
    ],

• Confidence: 84% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

"sensitiveExcludeSuggestion": [
      "*.key", "*.pem", "*.p12", "*.pfx",
      ".env", ".env.local", ".env.*.local",
      "credentials.json", "secrets.json",
      "*.token", "*.secret", "*_token.json",
      "id_rsa", "id_dsa", "*.ppk"
    ],

• Confidence: 84% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

// 敏感文件排除建议列表（默认不启用）
    "sensitiveExcludeSuggestion": [
      "*.key", "*.pem", "*.p12", "*.pfx",
      ".env", ".env.local", ".env.*.local",
      "credentials.json", "secrets.json",
      "*.token", "*.secret", "*_token.json",
      "id_rsa", "id_dsa", "*.ppk"

• Confidence: 86% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

// 敏感文件排除建议列表（默认不启用）
    "sensitiveExcludeSuggestion": [
      "*.key", "*.pem", "*.p12", "*.pfx",
      ".env", ".env.local", ".env.*.local",
      "credentials.json", "secrets.json",
      "*.token", "*.secret", "*_token.json",
      "id_rsa", "id_dsa", "*.ppk"

• Confidence: 86% confidence
• Finding: .env.local"

Credential Access

High

• Category: Privilege Escalation

Content

// 敏感文件排除建议列表（默认不启用，仅建议）
    sensitiveExcludeSuggestion: [
      "*.key", "*.pem", "*.p12", "*.pfx",
      ".env", ".env.local", ".env.*.local",
      "credentials.json", "secrets.json",
      "*.token", "*.secret",
      "*_key.json", "*_token.json",

• Confidence: 89% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

// 敏感文件排除建议列表（默认不启用，仅建议）
    sensitiveExcludeSuggestion: [
      "*.key", "*.pem", "*.p12", "*.pfx",
      ".env", ".env.local", ".env.*.local",
      "credentials.json", "secrets.json",
      "*.token", "*.secret",
      "*_key.json", "*_token.json",

• Confidence: 89% confidence
• Finding: .env.local"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.