Backup Full System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:43 PM UTC
• Version: 1.2.0

Overview

This cloud backup skill should be reviewed because it collects broad local and privileged system data and uploads it to Google Drive without clear scoping, confirmation, or encryption.

Install only after narrowing the backup to explicit OpenClaw paths, confirming the cloud remote, adding encryption before upload, and removing or separately approving collection of ~/.config, shell profiles, crontab, Tailscale, systemd files, and unrelated home-directory files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/backup_full_system.sh:18
• Finding: Excessive Collection and Unencrypted Cloud Upload of Sensitive Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup_full_system.sh`, lines 18-46 **Vulnerability Type**: Excessive privileged data access and plaintext sensitive-data transfer **Risk Level**: High ### Vulnerable Code ```bash # 2. SAO LƯU DANH SÁCH PHẦN MỀM & CRON apt-mark showmanual > $TMP_DIR/apt_packages.txt pip list --format=freeze > $TMP_DIR/python_libraries.txt 2>/dev/null crontab -l > $TMP_DIR/crontab_bak.txt 2>/dev/null # 3. SAO LƯU FILE CẤU HÌNH NGƯỜI DÙNG (Biến môi trường) cp ~/.bashrc ~/.profile ~/.bash_logout $TMP_DIR/ 2>/dev/null cp -r ~/.config $TMP_DIR/user_configs 2>/dev/null # 4. SAO LƯU CẤU HÌNH HỆ THỐNG (Cần quyền sudo cho các file nhạy cảm) # Sao lưu cấu hình Tailscale (nếu có) if [ -d "/etc/tailscale" ]; then sudo cp -r /etc/tailscale $TMP_DIR/etc_tailscale 2>/dev/null fi # Sao lưu các file dịch vụ tự tạo (Systemd) sudo cp /etc/systemd/system/openclaw* $TMP_DIR/systemd_services 2>/dev/null # 5. SAO LƯU TẬP TIN TRONG THƯ MỤC NGƯỜI DÙNG (Không bao gồm thư mục và file log) echo "--- ĐANG SAO LƯU TẬP TIN NGƯỜI DÙNG ---" mkdir -p $TMP_DIR/user_files # Tìm các file (không phải thư mục), không chứa 'log' trong tên, nằm trực tiếp trong PARENT_DIR find "$PARENT_DIR" -maxdepth 1 -type f ! -iname "*log*" -exec cp {} "$TMP_DIR/user_files/" \; 2>/dev/null # 6. ĐÓNG GÓI TẤT CẢ (Dữ liệu Bot + Cấu hình hệ thống) echo "--- ĐANG NÉN DỮ LIỆU ---" sudo tar -czf $BACKUP_DIR/$FILENAME -C $PARENT_DIR $SOURCE_NAME full_system_info # 7. ĐẨY LÊN GOOGLE DRIVE echo "--- ĐANG TẢI LÊN GOOGLE DRIVE ---" rclone copy $BACKUP_DIR/$FILENAME gdrive:OpenClaw_Backups ``` ### Technical Analysis The script recursively collects the entire `~/.config` directory, Tailscale configuration, shell startup files, cron entries, systemd service definitions, top-level user files, and the complete `.openclaw` directory. Several of these locations commonly contain access tokens, cloud credentials, private keys, authentication state, environment variables, command ...[truncated 2476 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace broad recursive collection with an explicit allowlist of OpenClaw files required for restoration. 2. Exclude credentials, private keys, authentication databases, tokens, Tailscale state, and unrelated application data by default. 3. Do not copy all of `~/.config`; identify only the specific non-secret configuration files needed by OpenClaw. 4. Remove Tailscale and systemd collection unless the user explicitly opts in after being shown the exact paths and risks. 5. Create an encrypted archive before upload using an authenticated encryption mechanism such as `age`, GPG, or an encrypted rclone remote. 6. Store encryption keys separately from the archive and cloud destination. 7. Validate and display the resolved rclone destination before transfer, and require confirmation for first use or destination changes. 8. Apply restrictive permissions with `umask 077` and verify that staging files and archives are readable only by the intended user. 9. Avoid `sudo` for the general archive operation. If privileged files are genuinely required, use a narrowly scoped helper or explicit allowlist. 10. Check all copy, archive, encryption, and upload exit statuses and abort securely if any stage fails. 11. Update the documentation to accurately enumerate collected data, privileged access, retention behavior, encryption requirements, and residual cloud risks. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup_full_system.sh:4
• Finding: Predictable Filesystem Paths Combined with Overbroad Privileged Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup_full_system.sh`, lines 4-10, 42, and 52-53 **Vulnerability Type**: Unsafe temporary files, insufficient path validation, and excessive use of `sudo` **Risk Level**: High ### Vulnerable Code ```bash PARENT_DIR="/home/jackie_chen_phong" SOURCE_NAME=".openclaw" BACKUP_DIR="$PARENT_DIR/backups" TMP_DIR="$PARENT_DIR/full_system_info" DATE=$(date +%Y-%m-%d_%Hh%M) FILENAME="Ultimate_Snapshot_$DATE.tar.gz" mkdir -p $BACKUP_DIR $TMP_DIR ``` ```bash sudo tar -czf $BACKUP_DIR/$FILENAME -C $PARENT_DIR $SOURCE_NAME full_system_info ``` ```bash sudo rm -rf $TMP_DIR find $BACKUP_DIR -type f -name "*.tar.gz" -mtime +7 -delete ``` ### Technical Analysis The staging and backup directories are fixed, predictable paths under a hardcoded home directory. The script does not verify path ownership, permissions, file type, or whether any component is a symbolic link. It also does not create the staging directory atomically. The archive filename is predictable to the minute. If another local principal can write to the relevant directory, that principal may be able to prepare filesystem objects before the script reaches its privileged operations. The `sudo tar` process then opens the predictable output path with elevated privileges. A maliciously prepared symbolic link at that path could redirect the privileged archive write and truncate or overwrite another file accessible to root. The staging path can likewise be replaced or redirected before execution. This can cause copied material to be written to an unintended location or cause the privileged archive operation to package attacker-influenced content. The recursive cleanup also runs with `sudo` against a fixed path without first validating that it remains the directory created by this invocation. Variable expansions such as `$BACKUP_DIR`, `$TMP_DIR`, and `$BACKUP_DIR/$FILENAME` are not quoted. Although the currently hardcoded values contain no whitespace, ...[truncated 2357 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a unique staging directory atomically with `mktemp -d`, preferably under a private directory owned by the invoking user. 2. Set `umask 077` before creating directories, staging files, or archives. 3. Quote every variable expansion, including: ```bash mkdir -p -- "$BACKUP_DIR" tar -czf "$BACKUP_DIR/$FILENAME" -C "$PARENT_DIR" "$SOURCE_NAME" "$(basename "$TMP_DIR")" ``` 4. Before any privileged operation, validate that each path: - Is absolute. - Is owned by the expected user. - Is not a symbolic link. - Has no attacker-writable parent component. - Resolves beneath the intended parent directory. 5. Create the archive initially in a securely created file, such as one produced by `mktemp`, rather than using a predictable minute-based output name. 6. Remove `sudo` from archive creation and cleanup whenever possible. 7. If privileged reads are necessary, copy only specifically approved files through a narrowly scoped privileged helper and archive the resulting user-owned staging directory without `sudo`. 8. Register a cleanup trap immediately after creating the staging directory, retain its exact canonical path, and refuse cleanup if ownership or file type changes. 9. Use `rm -rf -- "$validated_tmp_dir"` only after confirming that the path is nonempty, canonical, expected, and was created by the current process. 10. Replace the hardcoded home directory with a validated runtime value such as the intended account's resolved home directory, and fail safely if it does not match expectations. 11. Enable strict shell behavior such as `set -euo pipefail` and check the result of every security-sensitive filesystem operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to back up OpenClaw data, but the analysis indicates behavior extending beyond that scope, including collecting broader system/user information and copying sensitive system configuration under /etc and systemd. That mismatch is dangerous because users may authorize a routine application backup without realizing it can exfiltrate host-level secrets and infrastructure details to cloud storage.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Cài đặt công cụ nén và rclone
sudo apt update && sudo apt install -y tar zip rclone
```

### Cấu hình Đám mây (Rclone)

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script collects and archives data well beyond an OpenClaw backup, including package inventories, cron jobs, shell profiles, user config directories, host service definitions, and top-level user files. In the skill context, this is more dangerous because the stated purpose is an OpenClaw backup, yet the implementation silently performs broad host reconnaissance and data collection, increasing the risk of unintended sensitive data exfiltration.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script copies user shell startup files, the entire ~/.config tree, Tailscale configuration, systemd service definitions, and arbitrary top-level files from the user's home directory. In context, these locations commonly contain tokens, credentials, network settings, and unrelated personal or operational data, making the backup materially broader and more sensitive than the skill description suggests.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The archive is uploaded to Google Drive without any meaningful warning, confirmation, or summary of the sensitive contents being transferred. Given the script's broad collection scope, this creates a high risk of silent off-host exfiltration of credentials, configuration secrets, and personal data to a potentially misconfigured or shared cloud destination.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description does not clearly warn that the backup may upload sensitive local data to third-party cloud providers. In a skill that archives system state and then transfers it off-host, lack of explicit disclosure undermines informed consent and increases the risk of accidental exposure of secrets, credentials, and private user data.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Cài đặt công cụ nén và rclone
sudo apt update && sudo apt install -y tar zip rclone
```

### Cấu hình Đám mây (Rclone)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

DATE=$(date +%Y-%m-%d_%Hh%M)
FILENAME="Ultimate_Snapshot_$DATE.tar.gz"

mkdir -p $BACKUP_DIR $TMP_DIR

echo "--- ĐANG QUÉT TOÀN BỘ CẤU HÌNH HỆ THỐNG ---"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Recording installed APT packages, Python libraries, and cron entries captures system inventory and persistence-related configuration that is not obviously necessary to restore OpenClaw itself. This information can expose the software stack, scheduled jobs, and operational details useful for follow-on attacks if the archive or cloud destination is accessed by an unauthorized party.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 2. SAO LƯU DANH SÁCH PHẦN MỀM & CRON
apt-mark showmanual > $TMP_DIR/apt_packages.txt
pip list --format=freeze > $TMP_DIR/python_libraries.txt 2>/dev/null
crontab -l > $TMP_DIR/crontab_bak.txt 2>/dev/null

# 3. SAO LƯU FILE CẤU HÌNH NGƯỜI DÙNG (Biến môi trường)
cp ~/.bashrc ~/.profile ~/.bash_logout $TMP_DIR/ 2>/dev/null

• Confidence: 85% confidence
• Finding: Backing up crontab entries captures scheduled tasks that can reveal persistence mechanisms, automation secrets, maintenance jobs, and operational timing. Within an OpenClaw backup skill, this is outside the obvious minimum necessary scope and increases the sensitivity of the exported archive.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cp ~/.bashrc ~/.profile ~/.bash_logout $TMP_DIR/ 2>/dev/null
cp -r ~/.config $TMP_DIR/user_configs 2>/dev/null

# 4. SAO LƯU CẤU HÌNH HỆ THỐNG (Cần quyền sudo cho các file nhạy cảm)
# Sao lưu cấu hình Tailscale (nếu có)
if [ -d "/etc/tailscale" ]; then
    sudo cp -r /etc/tailscale $TMP_DIR/etc_tailscale 2>/dev/null

• Confidence: 90% confidence
• Finding: Using sudo to copy /etc/tailscale elevates the script's access to sensitive network identity and VPN configuration material. In this skill context, privileged access is especially risky because the resulting archive is later uploaded off-host, amplifying the consequences of collecting root-readable secrets.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 4. SAO LƯU CẤU HÌNH HỆ THỐNG (Cần quyền sudo cho các file nhạy cảm)
# Sao lưu cấu hình Tailscale (nếu có)
if [ -d "/etc/tailscale" ]; then
    sudo cp -r /etc/tailscale $TMP_DIR/etc_tailscale 2>/dev/null
fi
# Sao lưu các file dịch vụ tự tạo (Systemd)
sudo cp /etc/systemd/system/openclaw* $TMP_DIR/systemd_services 2>/dev/null

• Confidence: 88% confidence
• Finding: The script uses sudo to copy systemd service files matching openclaw*, which may contain environment variables, credentials, execution paths, and service-specific operational details. Privileged collection of these files is more dangerous here because the script does not clearly disclose the sensitivity of what will be uploaded externally.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo cp -r /etc/tailscale $TMP_DIR/etc_tailscale 2>/dev/null
fi
# Sao lưu các file dịch vụ tự tạo (Systemd)
sudo cp /etc/systemd/system/openclaw* $TMP_DIR/systemd_services 2>/dev/null

# 5. SAO LƯU TẬP TIN TRONG THƯ MỤC NGƯỜI DÙNG (Không bao gồm thư mục và file log)
echo "--- ĐANG SAO LƯU TẬP TIN NGƯỜI DÙNG ---"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 6. ĐÓNG GÓI TẤT CẢ (Dữ liệu Bot + Cấu hình hệ thống)
echo "--- ĐANG NÉN DỮ LIỆU ---"
sudo tar -czf $BACKUP_DIR/$FILENAME -C $PARENT_DIR $SOURCE_NAME full_system_info

# 7. ĐẨY LÊN GOOGLE DRIVE
echo "--- ĐANG TẢI LÊN GOOGLE DRIVE ---"

• Confidence: 93% confidence
• Finding: Running tar with sudo creates a root-readable archive from mixed user and system content, potentially sweeping in files with elevated confidentiality into a portable package. In context, this is risky because the archive is then transferred to cloud storage, turning privileged local access into externalized exposure.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

# 8. DỌN DẸP
sudo rm -rf $TMP_DIR
find $BACKUP_DIR -type f -name "*.tar.gz" -mtime +7 -delete

• Confidence: 78% confidence
• Finding: The script uses sudo for recursive deletion of the temporary directory, which introduces unnecessary risk if variables are changed, empty, or unexpected. Although likely intended only for cleanup, privileged deletion is hazardous because small path errors can become destructive.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The cleanup removes the temporary staging directory with sudo and deletes older archives automatically, with no confirmation or safety checks. While this appears intended as housekeeping rather than abuse, mistakes in path handling or user expectations could cause loss of forensic or recovery data.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The natural-language content is entirely in Vietnamese and addresses the user in that language without indicating that other languages are supported or optional. Under the language/locale policy, this can be a policy violation unless the locale restriction is explicitly justified or the user is given a choice.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The script's status and error messages are written only in Vietnamese, which imposes a specific language on users without opt-in or explanation. This can violate language or locale policy when the skill is intended for broader use and does not document a justified region-specific constraint.

Static analysis

No suspicious patterns detected.