Security audit

OpenClaw自动备份工具_auto-backup-openclaw-user-data

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is not clearly malicious, but it needs Review because it can back up more data than users may expect and mishandles some sensitive backup settings.

Install only if you are comfortable reviewing and tightening the configuration first: avoid full backups unless intended, enable sensitive-file exclusions and encryption, keep backups in a private dedicated directory, do not store Telegram tokens in copied prompts, and do not pass custom backup targets containing paths like .. or absolute paths.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/cli.js:87
Finding: Immediate backup command silently forces a full backup of sensitive OpenClaw data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cli.js:87-95`, `scripts/backup.js:136-157`, `scripts/config.js:27-47` **Vulnerability Type**: Least-privilege violation and unsafe sensitive-data backup default **Risk Level**: High ### Vulnerable Code ```js // scripts/cli.js:87-95 async cmdBackupNow(args) { const output = []; output.push('🔄 开始执行备份...'); output.push(''); try { const options = { full: args.full !== false, targets: args.targets }; const result = await this.backupManager.execute(options); ``` ```js // scripts/backup.js:136-157 async prepareTargets(options) { const openclawRoot = OPENCLAW_ROOT; const targets = []; // 检查备份模式 if (this.config.backup.mode === 'full' || options.full) { // 全量备份 targets.push({ path: openclawRoot, name: '.openclaw', isRoot: true }); } else { // 选择性备份 const targetNames = options.targets || this.config.backup.targets || []; for (const name of targetNames) { const targetPath = path.join(openclawRoot, name); ``` ```js // scripts/config.js:27-47 backup: { mode: "partial", // ← 修改默认为选择性备份 targets: [], // ← 改为空数组，首次加载时动态检测 // 默认排除（仅临时文件） exclude: ["logs", "cache", "tmp", "node_modules"], excludePatterns: ["*.log", "*.tmp", ".DS_Store", "Thumbs.db"], // 敏感文件排除建议列表（默认不启用，仅建议） sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk" ], sensitiveExcludeDirectories: [ "credentials", "secrets", ".ssh", ".gnupg" ], // 默认不启用敏感文件排除 enableSensitiveExclude: false }, ``` ### Technical Analysis The expression `args.full !== false` evaluates to `true` whenever the caller omits the `full` property. Consequently, an ordinary `/backup_now` invocation overrides the configured `partial` mode and enters the ful ...[truncated 1951 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the implicit full-backup default with an explicit opt-in: ```js const options = { full: args.full === true, targets: args.targets }; ``` 2. When no override is supplied, honor `config.backup.mode`. 3. Require explicit user confirmation before a full backup. 4. Enable sensitive-file and sensitive-directory exclusions by default. 5. Present an itemized warning before archiving credential stores, tokens, environment files, or private keys. 6. Default to encrypted archives when sensitive content is included. 7. Add automated tests confirming that `/backup_now` with empty arguments uses selective mode. 8. Report the effective backup scope before starting compression so that the caller can verify it. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/backup.js:148
Finding: Traversal-capable backup targets permit reads outside the OpenClaw directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup.js:148-157` **Vulnerability Type**: Path traversal resulting in arbitrary filesystem backup **Risk Level**: High ### Vulnerable Code ```js // scripts/backup.js:148-157 // 选择性备份 const targetNames = options.targets || this.config.backup.targets || []; for (const name of targetNames) { const targetPath = path.join(openclawRoot, name); if (await fs.pathExists(targetPath)) { targets.push({ path: targetPath, name: name, isRoot: false }); ``` The exported command interface accepts caller-provided arguments: ```js // scripts/cli.js:1551-1558 async function runCommand(command, args = {}) { const cli = new CLI(); return cli.execute(command, args); } module.exports = { CLI, runCommand ``` ### Technical Analysis Selective targets are joined to `OPENCLAW_ROOT` without canonicalization or a descendant-boundary check. Node.js path resolution allows `..` segments to escape the intended root. For example, joining `~/.openclaw` with `../.ssh` resolves to `~/.ssh`. Neither `prepareTargets()` nor configuration validation rejects absolute paths, traversal components, or resolved paths outside `~/.openclaw`. The exported `runCommand()` function allows a caller to supply the `targets` array directly. Once accepted, the directory walker recursively collects readable files from the escaped path and passes them to the compressor. This access exceeds the minimum privileges required for a Skill whose declared purpose is backing up OpenClaw user data. ### Attack Path 1. An Agent integration or local caller invokes: ```js runCommand('backup_now', { full: false, targets: ['../.ssh'] }); ``` 2. `cmdBackupNow()` passes the targets to `BackupManager.execute()`. 3. `prepareTargets()` computes a path equivalent to `~/.ssh`. 4. `fs.pathExists()` confirms that the escaped directory exists. 5. `walkDirectory()` recursively collects readable regular files from the directory. ...[truncated 880 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Canonicalize every target before use: ```js const root = path.resolve(OPENCLAW_ROOT); const candidate = path.resolve(root, name); if (candidate !== root && !candidate.startsWith(root + path.sep)) { throw new Error(`Backup target is outside the allowed root: ${name}`); } ``` 2. Reject absolute paths, null bytes, and any target containing `..` path components. 3. Prefer an allowlist of direct children discovered under `~/.openclaw` instead of accepting arbitrary strings. 4. Resolve symbolic links with `fs.realpath()` and verify that the real path remains under the allowed root. 5. Validate both command-supplied and configuration-supplied targets. 6. Ensure archive entry names cannot contain traversal components. 7. Add tests covering `../.ssh`, nested traversal, absolute paths, Windows drive paths, UNC paths, and symlink escapes. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cleaner.js:84
Finding: Retention cleanup can delete unrelated ZIP archives from configurable directories<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cleaner.js:84-99`, `scripts/cleaner.js:52-57` **Vulnerability Type**: Insufficient deletion-boundary validation **Risk Level**: Medium ### Vulnerable Code ```js // scripts/cleaner.js:84-99 async getBackupFiles() { try { const outputDir = this.config.output.path; const prefix = this.config.output.naming.prefix || 'auto-backup-openclaw-user-data'; if (!(await fs.pathExists(outputDir))) { return []; } const files = await fs.readdir(outputDir); const backups = []; for (const file of files) { // 只处理 .zip 文件 if (!file.endsWith('.zip')) continue; // 只处理以本 skill 前缀开头的文件 if (!file.startsWith(prefix)) continue; ``` ```js // scripts/cleaner.js:52-57 let deletedCount = 0; for (const file of toDelete) { try { await fs.remove(file.path); deletedCount++; await debug('Cleaner', `已删除: ${file.name}`); ``` ### Technical Analysis The cleanup mechanism assumes that any ZIP file in the configured output directory whose name starts with the configured prefix was created by this Skill. Both the output directory and naming prefix are configurable, but the code does not enforce a dedicated directory, validate prefix specificity, or verify file provenance. A broad prefix in a shared directory can therefore cause unrelated archives to be included in the retention set. Once those files are old enough or exceed the configured count limit, `fs.remove()` deletes them. The use of a filename prefix is not a reliable ownership boundary. No creation manifest, archive metadata, unique identifier, or trusted path registry is checked before deletion. ### Attack Path 1. Configure `output.path` to a shared archive directory. 2. Configure a broad prefix that matches unrelated ZIP files in that directory. 3. Enable retention by age or count. 4. Invoke a backup or `/backup_clean`; successful backups also trigger cleanup automatically when r ...[truncated 643 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Store backups in a dedicated directory controlled exclusively by this Skill. 2. Maintain a manifest containing the canonical path, creation timestamp, archive identifier, and checksum for every archive created by the Skill. 3. Delete only files present in the trusted manifest. 4. Use a fixed, non-user-controlled identifier in generated filenames rather than relying solely on a configurable prefix. 5. Canonicalize and validate the cleanup directory before enumeration. 6. Reject dangerously broad or empty prefixes. 7. Require explicit confirmation when cleanup operates outside the default dedicated backup directory. 8. Make preview or dry-run behavior the default for manual cleanup. 9. Consider moving files to a quarantine or trash directory before permanent deletion. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cli.js:1122
Finding: ZIP encryption passwords are weakly generated, echoed, and stored in plaintext<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cli.js:1029-1031`, `scripts/cli.js:1071-1073`, `scripts/cli.js:1122-1129`, `scripts/cli.js:1280-1290`, `scripts/config.js:187-200` **Vulnerability Type**: Insecure secret generation, disclosure, and storage **Risk Level**: Medium ### Vulnerable Code The generated password is displayed in the conversation: ```js // scripts/cli.js:1029-1031 output.push('系统已生成随机密码：'); output.push('━'.repeat(40)); output.push(''); output.push(` 密码：${randomPassword}`); ``` A user-provided password is also echoed: ```js // scripts/cli.js:1071-1073 } else if (input.length >= 8) { // 用户自定义密码 output.push('密码已设置：' + input); ``` Password generation uses `Math.random()`: ```js // scripts/cli.js:1122-1129 generateRandomPassword() { const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789#$@%&'; let password = ''; for (let i = 0; i < 16; i++) { password += chars.charAt(Math.floor(Math.random() * chars.length)); } return password; } ``` The password is assigned to the normal configuration object: ```js // scripts/cli.js:1280-1290 // 确保output.encryption配置结构存在 if (!config.output.encryption) { config.output.encryption = { enabled: false, password: null, algorithm: "aes-256", reminderShown: false }; } config.output.encryption.password = state.encryptionPassword; ``` The configuration is then written as ordinary JSON without an explicit restrictive mode: ```js // scripts/config.js:187-200 async function saveConfig(config) { try { await ensureConfigDir(); config.updatedAt = new Date().toISOString(); // 验证配置 const validation = validateConfig(config); if (!validation.valid) { throw new Error(`配置验证失败: ${validation.errors.join(', ')}`); } await fs.writeJson(CONFIG_FILE, config, { spaces: 2 }); ``` ### Technical Analysis `Math.random()` is not a cryptographically secure pseudorandom number generator and should not be use ...[truncated 1663 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate passwords with Node.js cryptographic randomness: ```js const crypto = require('crypto'); const password = crypto.randomBytes(24).toString('base64url'); ``` 2. Never include a complete password in conversational output, logs, error messages, or status responses. 3. Accept passwords through a secret-input mechanism that suppresses display and persistence in Agent history. 4. Store encryption keys in an operating-system keychain, credential vault, or OpenClaw secret-management facility. 5. If file-based storage is unavoidable, separate secrets from general configuration and enforce owner-only permissions such as `0600`. 6. Exclude password-bearing configuration from archives by default. 7. Support runtime password injection through a protected secret reference rather than plaintext configuration. 8. Rotate existing passwords after deploying the fix because previous values may already exist in history or backups. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (82)

Credential Access

High

Category: Privilege Escalation
Content: - **密钥文件**：*.key, *.pem, *.p12, *.pfx - **环境变量**：.env, .env.local, .env.*.local - **凭证文件**：credentials.json, secrets.json - **Token文件**：*.token, *.secret, *_token.json - **SSH密钥**：id_rsa, id_dsa, *.ppk
Confidence: 92% confidence
Finding: The same section documents that secret-bearing files such as secrets.json are not forcibly excluded from backups. Given this skill's purpose is automated archival of user data, retaining secrets by default expands the blast radius of any compromise of backup storage or transfer channels.

Credential Access

High

Category: Privilege Escalation
Content: - **密钥文件**：*.key, *.pem, *.p12, *.pfx - **环境变量**：.env, .env.local, .env.*.local - **凭证文件**：credentials.json, secrets.json - **Token文件**：*.token, *.secret, *_token.json - **SSH密钥**：id_rsa, id_dsa, *.ppk
Confidence: 92% confidence
Finding: The same section documents that secret-bearing files such as secrets.json are not forcibly excluded from backups. Given this skill's purpose is automated archival of user data, retaining secrets by default expands the blast radius of any compromise of backup storage or transfer channels.

Credential Access

High

Category: Privilege Escalation
Content: { "backup": { "exclude": ["logs", "cache", "*.key", ".ssh"], "excludePatterns": ["*.pem", ".env", "credentials.json"] } } ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: { "backup": { "exclude": ["logs", "cache", "*.key", ".ssh"], "excludePatterns": ["*.pem", ".env", "credentials.json"] } } ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: { "backup": { "exclude": ["logs", "cache", "*.key", ".ssh"], "excludePatterns": ["*.pem", ".env", "credentials.json"] } } ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: { "backup": { "exclude": ["logs", "cache", "*.key", ".ssh"], "excludePatterns": ["*.pem", ".env", "credentials.json"] } } ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The template instructs use of curl to call Telegram's external API directly from a backup workflow, introducing network egress and secret-handling behavior unrelated to core backup creation. Direct shell-based API calls also increase the chance of token leakage in process lists, logs, copied configs, or prompt history while sending operational details off-host.

Known Vulnerable Dependency: brace-expansion==1.1.13 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The lockfile includes brace-expansion 1.1.13, which is flagged for denial-of-service issues involving pathological brace patterns that can trigger excessive CPU or memory consumption. In this file it is a transitive dependency under minimatch/glob, so exploitation would depend on the application passing attacker-controlled glob or brace patterns into that dependency chain, but the presence of the vulnerable package is real and should be treated as a supply-chain risk.

Known Vulnerable Dependency: brace-expansion==2.0.3 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The lockfile also includes brace-expansion 2.0.3, which is likewise reported as vulnerable to resource-exhaustion DoS from crafted expansion input. Because this package is used transitively by readdir-glob/minimatch, risk is greatest if backup include/exclude selections or file-matching expressions can be influenced by users or untrusted configuration, potentially letting an attacker crash or stall backup jobs.

Credential Access

High

Category: Privilege Escalation
Content: *.pem # PEM证书文件 *.p12 # PKCS#12证书 *.pfx # PFX证书 .env # 环境变量文件 .env.local # 本地环境变量 .env.*.local # 环境变量文件变体 credentials.json # 凭证文件
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: *.p12 # PKCS#12证书 *.pfx # PFX证书 .env # 环境变量文件 .env.local # 本地环境变量 .env.*.local # 环境变量文件变体 credentials.json # 凭证文件 secrets.json # 密钥文件
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "excludePatterns": [ "*.log", "*.tmp", ".DS_Store", "Thumbs.db", "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", "credentials.json", "secrets.json" ], "exclude": ["logs", "cache", "tmp", "node_modules", ".ssh", ".gnupg"] }
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "excludePatterns": [ "*.log", "*.tmp", ".DS_Store", "Thumbs.db", "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", "credentials.json", "secrets.json" ], "exclude": ["logs", "cache", "tmp", "node_modules", ".ssh", ".gnupg"] }
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ssd 3

High

Confidence: 99% confidence
Finding: The configuration display path prints the full JSON config verbatim, and later flows also include plaintext password material. Since this skill manages backup settings and encryption secrets, dumping the full config can expose stored passwords, notification targets, paths, and other sensitive data to chat transcripts, logs, or unauthorized viewers.

Ssd 3

High

Confidence: 99% confidence
Finding: Displaying the randomly generated backup password directly in normal CLI/chat output exposes the very secret intended to protect the archive. In this skill context, where outputs may be retained or relayed, plaintext disclosure materially increases the chance of credential compromise and backup disclosure.

Ssd 3

High

Confidence: 99% confidence
Finding: Echoing a user-entered encryption password back verbatim leaks the secret into the output channel and any associated logging or transcript systems. This undermines confidentiality of encrypted backups and can expose sensitive archived user data if the archive is later accessed by an attacker with the leaked password.

Credential Access

High

Category: Privilege Escalation
Content: // 敏感文件排除建议列表（默认不启用，仅建议） sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json",
Confidence: 86% confidence
Finding: The code identifies .env.local as sensitive but does not exclude it unless the user manually enables the feature. Because this skill performs automated backups, local environment files may be silently archived on a schedule, increasing the chance of credential leakage through stored ZIPs or downstream handling.

Credential Access

High

Category: Privilege Escalation
Content: // 敏感文件排除建议列表（默认不启用，仅建议） sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json",
Confidence: 86% confidence
Finding: The code identifies .env.local as sensitive but does not exclude it unless the user manually enables the feature. Because this skill performs automated backups, local environment files may be silently archived on a schedule, increasing the chance of credential leakage through stored ZIPs or downstream handling.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: sensitiveExcludeSuggestion: [ "*.key", "*.pem", "*.p12", "*.pfx", ".env", ".env.local", ".env.*.local", "credentials.json", "secrets.json", "*.token", "*.secret", "*_key.json", "*_token.json", "id_rsa", "id_dsa", "*.ppk"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.