Backup Full System

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.2.0

Overview

This backup skill does perform backups, but it collects and uploads very sensitive local and system data with too little scoping, warning, or user control.

Install only if you intentionally want a broad, sensitive backup sent to the configured Google Drive remote. Before running it, review and edit the script paths, remove unrelated user/system files, add secret exclusions, encrypt the archive, confirm the rclone destination, and avoid cron scheduling unless recurring uploads are truly intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose says this skill backs up OpenClaw data, but the described behavior and referenced script scope extend into unrelated user and system data such as shell profiles, ~/.config, cron, package inventories, and files from a specific home directory. That mismatch is dangerous because users may consent to an application backup while the skill actually performs broad host collection and cloud exfiltration of additional sensitive data.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script collects substantially more than an OpenClaw backup requires, including package inventories, cron data, shell profiles, user config, systemd units, and Tailscale configuration. This broad host-state collection increases the sensitivity of the archive and creates unnecessary exposure if the backup is accessed by an unintended party or uploaded to a third-party cloud destination.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script copies unrelated user and host configuration such as ~/.bashrc, ~/.profile, ~/.config, cron entries, package lists, and privileged system configuration. These files can contain secrets, tokens, environment variables, service definitions, and operational details unrelated to OpenClaw, making the resulting archive far more sensitive than users would reasonably expect.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The skill is written as a broadly invokable backup capability without clear trigger constraints, approval requirements, or scope checks. In an agent setting, that makes unintended activation more likely, which is risky because the action packages and uploads large amounts of potentially sensitive system data.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The documentation promotes full-system backup to cloud storage but does not prominently warn that sensitive local data, configuration, memory, and possibly secrets may be transmitted off-host. Without a clear disclosure, users may not understand the privacy and security consequences of using the skill.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script automatically uploads a comprehensive backup archive to Google Drive via rclone without any explicit warning, confirmation, or review of contents. Because the archive includes broad user and system data, this creates a direct exfiltration path to an external service and could leak credentials, configuration, and sensitive host metadata.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script uses sudo to copy privileged configuration such as /etc/tailscale and systemd service definitions into the backup without warning the user that sensitive, root-owned material is being collected. These files can reveal network identity, service behavior, and secrets or tokens, materially increasing the risk profile of the backup.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs backup of database, configuration, and system 'memory' followed by upload to cloud storage, which implies collection and external disclosure of highly sensitive operational and user data. In security terms, this is data exfiltration functionality unless tightly scoped, consented to, and protected with encryption and minimization.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The workflow tells the agent to enumerate workspace, configs, and memory, package them, and upload them to the cloud. That combination materially increases danger because it turns broad local discovery into a transfer mechanism for potentially confidential code, credentials, tokens, and user content.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.