iScandium OpenClaw Samba Backup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:12 PM UTC
• Version: 1.0.0

Overview

This backup skill is not clearly malicious, but it stores administrator credentials and can run unattended root-level backups and deletions to a remote Samba share with weak path controls.

Install only after redesign or careful administrative review. Do not put a real local administrator password in this skill's JSON config; prefer a dedicated backup account, protected secret storage, a fixed mount point, validated backup paths, and tightly scoped sudo rules or a root-owned helper. Enable the cron automation only after confirming exactly which local directory is backed up, which Samba destination receives it, and what old backups can be deleted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:27

Finding

Unvalidated Configurable Paths Enable Privileged Filesystem Traversal and Destructive Operations

Content

View full analysis

/dev/null # Mount the Samba share echo "Mounting Samba share..." echo "$source_admin_password" | sudo -S mount -t cifs "//$target_server_ip/$target_share_name" "$mount_point" \ -o username="$target_share_username",password="$target_share_password",vers="$mount_vers" ``` ```bash # Create the destination directory TARGET_DIR="$mount_point/$target_folder/$TIMESTAMP" echo "$source_admin_password" | sudo -S mkdir -p "$TARGET_DIR" # Perform the backup echo "Synchronizing files..." echo "$source_admin_password" | sudo -S cp -R "$source_dir/." "$TARGET_DIR/" ``` ```bash BACKUP_BASE="$mount_point/$target_folder" OLD_BACKUPS=$(ls -1r "$BACKUP_BASE" 2>/dev/null | grep -E '^[0-9]{4}-[0-9]{2}-[0-9]{2}_[0-9]{2}-[0-9]{2}-[0-9]{2}$' | tail -n +$((max_backups + 1))) if [ -n "$OLD_BACKUPS" ]; then for old_backup in $OLD_BACKUPS; do echo "Deleting old backup: $old_backup" echo "$source_admin_password" | sudo -S rm -rf "$BACKUP_BASE/$old_backup" 2>/dev/null || true done else echo "No old backu ...[truncated 2577 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: config/default.json:4

Finding

Reusable Administrator and Samba Passwords Are Stored and Exposed in Plaintext

Content

View full analysis

/dev/null echo "Mounting Samba share..." echo "$source_admin_password" | sudo -S mount -t cifs "//$target_server_ip/$target_share_name" "$mount_point" \ -o username="$target_share_username",password="$target_share_password",vers="$mount_vers" ``` ### T ...[truncated 2092 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/backup.sh:27

Finding

Configurable Source Directory Allows Root-Level Exfiltration of Arbitrary Local Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill presents itself as a simple backup helper, but the documented behavior includes privileged operations, handling of local admin and Samba credentials, filesystem mount/unmount actions, and deletion of old backups. This mismatch is dangerous because users may trigger automatic execution without understanding the full trust and data-access scope, increasing the chance of credential exposure, destructive actions, or unintended remote data transfer.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Piping a stored admin password into sudo chains untrusted script logic directly into privileged execution. This is dangerous because compromise of the configuration or any upstream manipulation of parameters immediately becomes root-capable automation.

Content

Scanner excerpt · scripts/backup.sh (reported line 74)May include surrounding context.

sh

# 创建挂载点
if [ ! -d "$mount_point" ]; then
    echo "$source_admin_password" | sudo -S mkdir -p "$mount_point"
fi

# 卸载已挂载的共享（如果存在）

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The pipeline into sudo for unmounting is part of a repeated pattern where script-controlled values are used in root operations. In context, the skill handles network mounts, so chaining directly to privileged system commands increases the chance of system disruption from misconfiguration or abuse.

Content

Scanner excerpt · scripts/backup.sh (reported line 78)May include surrounding context.

sh

fi

# 卸载已挂载的共享（如果存在）
echo "$source_admin_password" | sudo -S umount "$mount_point" 2>/dev/null

# 挂载 Samba 共享
echo "正在挂载 Samba 共享..."

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Here the chain is most dangerous: a stored local admin password is piped into a root mount command that also carries remote authentication material. This tightly couples secret exposure, privileged execution, and network resource control in one step.

Content

Scanner excerpt · scripts/backup.sh (reported line 82)May include surrounding context.

sh

# 挂载 Samba 共享
echo "正在挂载 Samba 共享..."
echo "$source_admin_password" | sudo -S mount -t cifs "//$target_server_ip/$target_share_name" "$mount_point" \
    -o username="$target_share_username",password="$target_share_password",vers="$mount_vers"

if [ $? -ne 0 ]; then

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The script chains password input into privileged directory creation on the mounted share, letting script-controlled path values drive root actions. That is unnecessary for ordinary backup behavior and increases the effect of any path misconfiguration.

Content

Scanner excerpt · scripts/backup.sh (reported line 92)May include surrounding context.

sh

# 创建目标目录
TARGET_DIR="$mount_point/$target_folder/$TIMESTAMP"
echo "$source_admin_password" | sudo -S mkdir -p "$TARGET_DIR"

# 执行 cp 备份
echo "正在同步文件..."

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Password-to-sudo chaining for recursive copy means the script can turn a leaked admin password into privileged data access and remote transfer. In a backup context, this raises exfiltration risk if the source path is broadened beyond the intended OpenClaw directory.

Content

Scanner excerpt · scripts/backup.sh (reported line 96)May include surrounding context.

sh

# 执行 cp 备份
echo "正在同步文件..."
echo "$source_admin_password" | sudo -S cp -R "$source_dir/." "$TARGET_DIR/"

if [ $? -eq 0 ]; then
    echo ""

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The same chain appears in failure cleanup, so even error paths retain root-capable behavior. This reflects an unsafe design pattern rather than a one-off necessity.

Content

Scanner excerpt · scripts/backup.sh (reported line 103)May include surrounding context.

sh

echo "=== 备份完成 ==="
else
    echo "错误：备份失败"
    echo "$source_admin_password" | sudo -S umount "$mount_point"
    exit 1
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The rm -rf "$BACKUP_BASE/$old_backup" deletion target depends on mounted-path state, configuration-derived base paths, and shell iteration over listed directory names. Although the regex on backup names reduces trivial injection, the command is still a high-risk destructive primitive in a backup script because path confusion or mount issues can wipe unintended data under elevated privileges.

Content

Scanner excerpt · scripts/backup.sh (reported line 117)May include surrounding context.

sh

if [ -n "$OLD_BACKUPS" ]; then
    for old_backup in $OLD_BACKUPS; do
        echo "删除旧备份: $old_backup"
        echo "$source_admin_password" | sudo -S rm -rf "$BACKUP_BASE/$old_backup" 2>/dev/null || true
    done
else
    echo "没有需要清理的旧备份"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Chaining a stored admin password into sudo rm -rf is the highest-risk pattern in the file. If configuration, mount state, or target path selection is wrong or tampered with, the script can perform irreversible privileged deletion with no interactive barrier.

Content

Scanner excerpt · scripts/backup.sh (reported line 117)May include surrounding context.

sh

if [ -n "$OLD_BACKUPS" ]; then
    for old_backup in $OLD_BACKUPS; do
        echo "删除旧备份: $old_backup"
        echo "$source_admin_password" | sudo -S rm -rf "$BACKUP_BASE/$old_backup" 2>/dev/null || true
    done
else
    echo "没有需要清理的旧备份"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Final unmount still uses direct password-to-root chaining, extending the unsafe privileged automation pattern through the full lifecycle. While less destructive than deletion, it confirms excessive trust in embedded credentials.

Content

Scanner excerpt · scripts/backup.sh (reported line 126)May include surrounding context.

sh

# 卸载共享
echo ""
echo "正在卸载共享..."
echo "$source_admin_password" | sudo -S umount "$mount_point"

echo "完成！"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises automatic execution for backups but does not prominently warn that it will access user data and transmit it to a remote Samba server using stored credentials. In an agent context, silent automatic handling of sensitive files and secrets can lead to unintentional data exfiltration or use of incorrect remote destinations without informed consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The documentation indicates the skill requires a local administrator password for sudo-backed operations. Storing or supplying admin credentials to an automated backup workflow materially increases risk of privilege misuse, credential theft, and system-wide impact if the script, config, or execution environment is compromised.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

| `target_share_username` | Samba 用户名 |
| `target_share_password` | Samba 密码 |
| `source_admin_username` | 本服务器管理员用户名 |
| `source_admin_password` | 管理员密码（sudo 用） |
| `max_backups` | 保留备份数量（默认 7） |
| `source_dir` | 备份源路径（默认 ~/.openclaw） |
| `target_folder` | 目标文件夹名（默认 hostname） |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

• cifs-utils（Samba 客户端）

bash

sudo apt install cifs-utils

目录结构

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest/config file contains user-facing titles and descriptions exclusively in Chinese, which imposes a specific language on users without offering opt-in or documenting that the skill is intended only for a Chinese-language audience. That matches the policy category for language or locale constraints in natural-language content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The schema explicitly collects a local administrator username for performing sudo-based mount operations, indicating the skill is designed around privileged execution with reusable admin credentials. In a backup skill, this increases risk because compromise of the skill, logs, or parameter handling could expose local administrative access and enable full host takeover.

Content

Scanner excerpt · config/params.schema.json (reported line 28)May include surrounding context.

json

"source_admin_username": {
      "type": "string",
      "title": "本服务器管理员用户名",
      "description": "用于执行 sudo 挂载操作的管理员账户"
    },
    "source_admin_password": {
      "type": "string",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The schema requests the local administrator password and states it will be used for sudo mount and cp operations, which is a strong indicator that the skill will handle plaintext privileged credentials. That creates a serious attack surface: secrets may be stored, logged, reused unsafely, or exposed to downstream commands, allowing privilege escalation and persistent compromise of the source server.

Content

Scanner excerpt · config/params.schema.json (reported line 33)May include surrounding context.

json

"source_admin_password": {
      "type": "string",
      "title": "本服务器管理员密码",
      "description": "管理员密码，用于 sudo 挂载和执行 cp",
      "format": "password"
    },
    "max_backups": {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script extracts plaintext Samba credentials and a local admin password from a JSON file, then uses them for network authentication and privileged execution without clear warning or protection. This creates multiple opportunities for credential theft through file disclosure, process inspection, logs, backups of the config, or later misuse by anyone who can alter the script flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads a local admin password from configuration and repeatedly pipes it into sudo -S to perform privileged filesystem and mount operations. That expands the skill from simple data backup into local privilege use, creates a plaintext credential exposure risk, and enables privileged actions if the config or script is modified or abused.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Using sudo -S specifically means the script accepts and forwards a password through stdin, which is an unsafe credential handling pattern. It normalizes embedding privileged authentication into automation and makes compromise of the config immediately useful for privilege escalation.

Content

Scanner excerpt · scripts/backup.sh (reported line 74)May include surrounding context.

sh

# 创建挂载点
if [ ! -d "$mount_point" ]; then
    echo "$source_admin_password" | sudo -S mkdir -p "$mount_point"
fi

# 卸载已挂载的共享（如果存在）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Using sudo -S specifically means the script accepts and forwards a password through stdin, which is an unsafe credential handling pattern. It normalizes embedding privileged authentication into automation and makes compromise of the config immediately useful for privilege escalation.

Content

Scanner excerpt · scripts/backup.sh (reported line 74)May include surrounding context.

sh

# 创建挂载点
if [ ! -d "$mount_point" ]; then
    echo "$source_admin_password" | sudo -S mkdir -p "$mount_point"
fi

# 卸载已挂载的共享（如果存在）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

sudo -S umount relies on a reusable local admin secret and performs a privileged system action from script logic. This creates a straightforward path from secret exposure to system-impacting command execution.

Content

Scanner excerpt · scripts/backup.sh (reported line 78)May include surrounding context.

sh

fi

# 卸载已挂载的共享（如果存在）
echo "$source_admin_password" | sudo -S umount "$mount_point" 2>/dev/null

# 挂载 Samba 共享
echo "正在挂载 Samba 共享..."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

sudo -S umount relies on a reusable local admin secret and performs a privileged system action from script logic. This creates a straightforward path from secret exposure to system-impacting command execution.

Content

Scanner excerpt · scripts/backup.sh (reported line 78)May include surrounding context.

sh

fi

# 卸载已挂载的共享（如果存在）
echo "$source_admin_password" | sudo -S umount "$mount_point" 2>/dev/null

# 挂载 Samba 共享
echo "正在挂载 Samba 共享..."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

sudo -S mount combines privileged execution with password forwarding and additional plaintext network credentials in mount options. This makes the backup workflow especially sensitive because both local privilege and remote-share authentication can be compromised or misused together.

Content

Scanner excerpt · scripts/backup.sh (reported line 82)May include surrounding context.

sh

# 挂载 Samba 共享
echo "正在挂载 Samba 共享..."
echo "$source_admin_password" | sudo -S mount -t cifs "//$target_server_ip/$target_share_name" "$mount_point" \
    -o username="$target_share_username",password="$target_share_password",vers="$mount_vers"

if [ $? -ne 0 ]; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

sudo -S mount combines privileged execution with password forwarding and additional plaintext network credentials in mount options. This makes the backup workflow especially sensitive because both local privilege and remote-share authentication can be compromised or misused together.

Content

Scanner excerpt · scripts/backup.sh (reported line 82)May include surrounding context.

sh

# 挂载 Samba 共享
echo "正在挂载 Samba 共享..."
echo "$source_admin_password" | sudo -S mount -t cifs "//$target_server_ip/$target_share_name" "$mount_point" \
    -o username="$target_share_username",password="$target_share_password",vers="$mount_vers"

if [ $? -ne 0 ]; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

sudo -S mkdir on the remote-mounted path extends the password-based privileged pattern to write operations on the backup target. If target path values are unexpected, the script can create or modify directories under elevated context without user review.

Content

Scanner excerpt · scripts/backup.sh (reported line 92)May include surrounding context.

sh

# 创建目标目录
TARGET_DIR="$mount_point/$target_folder/$TIMESTAMP"
echo "$source_admin_password" | sudo -S mkdir -p "$TARGET_DIR"

# 执行 cp 备份
echo "正在同步文件..."

Static analysis

No suspicious patterns detected.