ClawHub
Back to skill

Security audit

File Backup

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local backup skill with disclosed file-copy and cleanup behavior, but users should handle sensitive backups carefully.

Install only if you want the agent to create local backup copies before editing important files. For sensitive files, use a private backup directory, verify paths before deletion, and clean up stale backups when they are no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:29
Finding

Predictable and Insufficiently Protected Sensitive Backup Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–34, 42–50, and 54–67
Vulnerability Type: Unsafe backup-file creation and retention
Risk Level: Medium

The skill prescribes copying important or sensitive files to a predictable backup location and retaining those copies until explicit user confirmation. The relevant command examples are:

sh
cp config.json backups/config.json.2026-03-14.bak
sh
rm backups/xxx.bak

The documented rules also establish that backups remain indefinitely if the user does not authorize deletion. Files identified as candidates include configuration files, core Agent files, and other user-designated sensitive files.

Technical Analysis

The workflow does not require:

  • Restrictive permissions on the backups/ directory or created files.
  • Verification that the destination directory and file are not symbolic links.
  • Exclusive or atomic destination-file creation.
  • Collision-resistant backup names.
  • Path validation or protection against option-like filenames.
  • A maximum retention period for abandoned backups.
  • Cleanup of stale backup files.

The predictable pattern backups/<filename>.<date>.bak allows an attacker with write access to the backup directory to anticipate the destination. Depending on the behavior and privileges of the cp implementation, a pre-created destination symbolic link could redirect the copy and overwrite another file accessible to the Agent. Ambient directory permissions could also make copied configuration or Agent-state data readable by other local users or processes.

This is a conditional local vulnerability: exploitation requires the attacker to have write or observation access to the selected backup directory. The workflow itself does not grant such access.

Attack Path

  1. The attacker obtains write access to the default or user-selected backup directory.
  2. The attacker predicts the destination ...[truncated 1253 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a dedicated backup directory with mode 0700 and verify that it is owned by the expected user.
  2. Reject backup directories and destination files that are symbolic links or resolve outside the approved backup root.
  3. Create backup files atomically and exclusively with mode 0600; fail safely if a destination already exists.
  4. Use collision-resistant names containing a full timestamp and a securely generated random component rather than only a date.
  5. Validate and canonicalize source and destination paths before performing filesystem operations.
  6. Use option termination for command-line paths, such as cp -- "$source" "$destination" and rm -- "$destination".
  7. Verify that the source is a regular file unless other file types are explicitly supported.
  8. Define a retention period and notify the user about stale backups instead of retaining them indefinitely.
  9. Before deletion, verify that the selected path is the exact recorded backup, remains inside the authorized backup directory, and has not been replaced by a symbolic link.
  10. Prefer a filesystem API with explicit no-follow and exclusive-creation controls over constructing shell commands from variable paths.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: "00000000000000000000000000000000"
    PropagateID: "00000000000000000000000000000000"
    ReservedCode1: 304502200aeae2a301f4803eddb248d5a31e8f539736d5b0e84643401248863a59f9eca1022100e7e82e85cab6b1ae66ca1a16448f3040078325c951f548293f5fa5db92d710b0
    ReservedCode2: 3046022100fc82f0e2c81471b88f6b6b7a00b32cf8d6a29f3967440c99e21ba69202a99f7c022100fc848215ff03569403cb6b70bbf52dde4cb45e739cb8cae35ea576a2129e7f53
description: |-
    修改文件前的自动备份工具。
    当需要修改重要文件时，先备份再修改，改完后让用户检查，确认无误后删除备份。
name: file-backup
---

# File Backup Skill

## 触发条件

修改重要文件前，特别是：
- 配置文件
- �

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The skill instructs deletion of a backup file via a raw shell command pattern (rm backups/xxx.bak) after user confirmation, but it does not require path validation, canonicalization, or safe handling of attacker-controlled filenames. If the backup path or filename is derived from a manipulated original path, this can lead to arbitrary file deletion, path traversal, or deletion of unintended files.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

4. 删除备份

收到用户确认后：

text
rm backups/xxx.bak
备份已删除

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation text says to use the skill before modifying 'important files' and gives broad categories like configuration files, core mechanism files, and user-designated sensitive files, but it does not define clear boundaries for what counts as important. This ambiguity could cause unintended invocation in many ordinary editing situations because there are no exclusion conditions or negative examples.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.