T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:159
- Finding
- Automatic Remote Backup Includes Credentials and Sensitive OpenClaw State## Vulnerability Details **File Location**: `SKILL.md`, lines 159–166 **Vulnerability Type**: Sensitive data exposure through an unsafe backup configuration **Risk Level**: High ### Complete Code Snippet ```text ## 2. 大脑灾备 - **仓库**：GitHub 私有仓库或其它备份方案 - **备份内容**：`openclaw.json`, `workspace/`, `agents/`, `cron/`, `credentials/`, `identity/`, `devices/paired.json`, `.config-baseline.sha256` - **排除**：`devices/*.tmp`, `media/`, `logs/`, `completions/`, `canvas/`, `*.bak*`, `*.tmp` - **频率**：每日巡检时自动备份 ``` ### Technical Analysis The Skill instructs the Agent to perform a daily remote Git backup containing `credentials/`, `identity/`, `devices/paired.json`, `openclaw.json`, and potentially sensitive data under `workspace/` and `agents/`. These locations can contain authentication material, device-pairing state, configuration secrets, private operational context, or other data that should not be placed directly in Git. A private repository is not a secret-management boundary. Sensitive content committed to Git remains in repository history even after deletion from the latest revision. It may become accessible through compromised Git credentials, excessive collaborator permissions, CI/CD integrations, repository mirrors, accidental visibility changes, local clones, or compromise of the hosting account. Automatically exporting these paths is not required to perform the declared security-audit function and exceeds the minimum data access and transfer necessary for nightly monitoring. No instruction to encrypt the data before transfer, sanitize secrets, enforce retention controls, or use an explicit non-sensitive allowlist is provided. ### Attack Path 1. A user follows the Skill and deploys the prescribed nightly audit and backup process. 2. The recurring process collects OpenClaw state, including `credentials/`, `identity/`, `devices/paired.json`, and configuration or workspace data. 3. The collected files are committed to Git a ...[truncated 1337 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `credentials/`, `identity/`, `devices/paired.json`, and secret-bearing portions of `openclaw.json` from the default backup scope. 2. Replace the broad directory list with an explicit allowlist containing only data demonstrated to be non-sensitive and necessary for disaster recovery. 3. Require informed user approval for the backup destination, included files, retention period, repository access policy, and recovery procedure. 4. Encrypt backup archives locally before upload using a key stored separately from both the repository and its access credentials. 5. Do not commit plaintext secrets to Git, including private repositories. Use an appropriate encrypted backup system or secret manager instead. 6. Add automated secret scanning as a pre-commit and pre-push control, and fail closed when potential credentials or private keys are detected. 7. Use a dedicated, least-privileged backup identity restricted to one destination and prevent unrelated CI systems or collaborators from reading the backup. 8. Define key rotation and incident-response procedures for cases where sensitive content has already entered Git history. Removing the latest file is insufficient; purge historical objects and rotate every potentially exposed credential. 9. Minimize retention, maintain access logs, and periodically test restoration from encrypted backups without exposing production secrets.