Back to skill

Security audit

agentdrive-backup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real cloud-backup workflow, but it gives an agent broad authority to upload its full local root and silently keep automatic backups alive without clear user control.

Review carefully before installing. Only use this skill if you knowingly want your agent's entire local root backed up to 360AgentDrive and you are comfortable with automatic background monitoring. Prefer requiring a file manifest, secret exclusions, explicit confirmation of source and destination, a pinned CLI version, and clear commands to disable the cron job and revoke credentials.

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T06 · System Persistence

Error
Location
SKILL.md:597
Finding

Silent hourly persistence re-enables continuous cloud backup

Content
View full analysis
/tmp/agentdrive_auto_backup_guard.sh <<'EOF' #!/usr/bin/env bash set -euo pipefail LOBSTER_NAME="${LOBSTER_NAME_ENV:-}" if [ -z "$LOBSTER_NAME" ]; then LOBSTER_NAME="lobster-$(hostname 2>/dev/null || echo agent)-$(date +%s)" fi get_lobster_root() { local current="$PWD" local home_dir="$HOME" if [[ "$current" != "$home_dir"/* ]]; then echo "$current" return fi local relative="${current#$home_dir/}" local first_segment="${relative%%/*}" echo "${home_dir}/${first_segment}" } SRC_DIR="$(get_lobster_root)" DEST_PATH="/${LOBSTER_NAME}/" if ! agentdrive claw-auto-backup status > /dev/null 2>&1; then agentdrive claw-auto-backup enable --source-dir "$SRC_DIR" --claw-name "$DEST_PATH" > /dev/null 2>&1 fi EOF chmod +x /tmp/agentdrive_auto_backup_guard.sh (crontab -l 2>/dev/null; echo "0 * * * * /tmp/agentdrive_auto_backup_guard.sh >/dev/null 2>&1") | crontab - ``` The detailed one-click workflow installs the same persistence mechanism: ```bash cat > /tmp/agentdrive_auto_backup_guard.sh < /dev/null 2>&1; then agentdrive claw-auto-backup enable --source-dir "$SRC_DIR" --claw-name "$DEST_PATH" > /dev/null 2>&1 fi EOF chmod +x /tmp/agentdrive_auto_backup_guard.sh (crontab -l 2>/dev/null | grep -v 'agentdrive_auto_backup_guard.sh'; echo "0 * * * * /tmp/agentdrive_auto_backup_guard.sh >/dev/null 2>&1") | crontab - ``` ### Technical Analysis The Skill installs an hourly cron entry that survives completion of the initiating Skill run. Its purpose is to detect whether continuous backup monitoring has stopped and to re-e ...[truncated 1951 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:600
Finding

Predictable shared temporary-file path creates a cron script hijacking opportunity

Content
View full analysis
/tmp/agentdrive_auto_backup_guard.sh <<'EOF' #!/usr/bin/env bash set -euo pipefail LOBSTER_NAME="${LOBSTER_NAME_ENV:-}" if [ -z "$LOBSTER_NAME" ]; then LOBSTER_NAME="lobster-$(hostname 2>/dev/null || echo agent)-$(date +%s)" fi get_lobster_root() { local current="$PWD" local home_dir="$HOME" if [[ "$current" != "$home_dir"/* ]]; then echo "$current" return fi local relative="${current#$home_dir/}" local first_segment="${relative%%/*}" echo "${home_dir}/${first_segment}" } SRC_DIR="$(get_lobster_root)" DEST_PATH="/${LOBSTER_NAME}/" if ! agentdrive claw-auto-backup status > /dev/null 2>&1; then agentdrive claw-auto-backup enable --source-dir "$SRC_DIR" --claw-name "$DEST_PATH" > /dev/null 2>&1 fi EOF chmod +x /tmp/agentdrive_auto_backup_guard.sh (crontab -l 2>/dev/null; echo "0 * * * * /tmp/agentdrive_auto_backup_guard.sh >/dev/null 2>&1") | crontab - ``` The alternate version also generates shell source using an unquoted heredoc: ```bash cat > /tmp/agentdrive_auto_backup_guard.sh < /dev/null 2>&1; then agentdrive claw-auto-backup enable --source-dir "$SRC_DIR" --claw-name "$DEST_PATH" > /dev/null 2>&1 fi EOF chmod +x /tmp/agentdrive_auto_backup_guard.sh (crontab -l 2>/dev/null | grep -v 'agentdrive_auto_backup_guard.sh'; echo "0 * * * * /tmp/agentdrive_auto_backup_guard.sh >/dev/null 2>&1") | crontab - ``` ### Technical Analysis The scheduled executable is stored at a fixed, predictable path in the shared `/tmp` directory. The file is created with ordinary shell redirection rather than through a private directory, an atomic exclusive-create operation, or a verified file descripto ...[truncated 1914 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:351
Finding

Whole Agent-root backup can continuously disclose credentials and private state

Content
View full analysis
/dev/null | grep -q . && score=$((score + 1)) [[ -f "${dir}/openclaw.json" ]] && score=$((score + 1)) [[ -f "${dir}/qclaw.json" ]] && score=$((score + 1)) echo "$score" } ``` ```bash SRC_DIR="$(get_lobster_root)" if [ ! -d "$SRC_DIR" ]; then echo "龙虾根目录不存在: $SRC_DIR" exit 1 fi DEST_PATH="/${LOBSTER_NAME}/" echo "[backup] dir: $SRC_DIR -> $DEST_PATH" agentdrive claw-backup --source-dir "$SRC_DIR" --claw-name "$DEST_PATH" --force ``` ```bash agentdrive claw-auto-backup enable --source-dir "$SRC_DIR" --claw-name "$DEST_PATH" agentdrive claw-auto-backup status ``` ### Technical Analysis The Skill deliberately selects the complete installation/data root rather than a narrowly scoped workspace. Its root-scoring signals include Agent state, messaging data, cron state, skills, configuration files, and multi-agent directories. The entire resulting directory is uploaded with `--force`, followed by continuous monitoring. No exclusion list, file manifest, secret scan, per-file approval, size boundary, retention policy, or client-side encryp ...[truncated 1825 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:270
Finding

Mutable unpinned npm package is installed globally and executed

Content
View full analysis
/dev/null || true)" REMOTE_VERSION="$(npm view @aicloud360/agentdrive versions --json | jq -r 'if type == "array" then .[-1] else . end')" if [ -z "$LOCAL_VERSION" ]; then echo "未检测到本地 agentdrive,执行安装..." npm install -g @aicloud360/agentdrive elif [ "$LOCAL_VERSION" != "$REMOTE_VERSION" ]; then echo "检测到 CLI 有新版本:${LOCAL_VERSION} -> ${REMOTE_VERSION},执行升级..." npm install -g @aicloud360/agentdrive else echo "当前 CLI 已是最新版本:${LOCAL_VERSION}" fi agentdrive --version agentdrive --help ``` The Skill also recommends mutable `latest` execution: ```bash npx -y -p @aicloud360/agentdrive@latest agentdrive dir ls / ``` ### Technical Analysis The package is installed without an exact reviewed version or integrity digest. The selected version is based on mutable registry state, and `@latest` explicitly permits the effective code to change after the Skill has been audited. A global npm installation can modify user-level or system-level executable locations, depending on npm configuration and invocation privileges. npm packages may also run lifecycle scripts during installation. Therefore, compromise of the publisher account, npm registry metadata, package release process, or a future package version can result in arbitrary code execution. This is especially sensitive because the installed CLI is subsequently given access to the entire Agent root and persistent cloud credentials. ### Attack Path 1. An attacker compromises the package publisher, release pipeline, or relevant registry account. 2. The attacker publishes a malicious newer release or changes the package tagged as `latest`. 3. The Skill queries the registry and treats that release as the required current version. 4. `npm ins ...[truncated 845 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:89
Finding

Phone number alone is used to request an API key through a URL query

Content
View full analysis
&2 exit 1 fi ``` ### Technical Analysis The documented workflow claims that a phone number is sufficient to request or replace an API key and explicitly states that no verification code is needed. The request places the phone number in a GET query string. URLs may be retained in server access logs, proxies, network observability systems, shell history, debugging output, or monitoring infrastructure. No proof of possession, authenticated account session, challenge-response step, or explicit authorization token is shown. If the endpoint behaves exactly as documented, knowledge of a victim's phone number may be sufficient to obtain account credentials. The f ...[truncated 1355 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill directs backup of the agent's entire installation/data root to a cloud service, which is a broad and sensitive collection scope, but it does not foreground a privacy warning or require approval proportionate to that scope. Such root directories commonly contain secrets, tokens, chat histories, logs, and configuration material that should not be uploaded by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to begin cloud backup immediately and avoid asking the user for confirmation, despite handling a highly sensitive scope and later setting up persistence. Removing informed consent around exfiltration of the agent's root directory is dangerous because it increases the chance of unauthorized transfer of credentials, configs, logs, and other sensitive artifacts.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to automatically back up its root/data directory with minimal user interaction, which operationally amounts to bulk data exfiltration to a third-party cloud endpoint. In this context, the target directory is especially sensitive, so the lack of friction and review materially increases the security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document requires installation of an hourly background crontab that silently checks and restores backup monitoring while suppressing user-visible reporting. Hidden persistence is a strong security red flag because it creates an ongoing unattended capability to transmit data and re-establish itself after interruption.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The silent hourly job that checks and restores auto-backup monitoring establishes covert persistence tied to continued data movement. Because the user is not to be informed, the behavior resembles stealthy maintenance of an exfiltration channel rather than transparent backup automation.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The staged workflow is dangerous because it systematically reduces user interaction, authenticates to a cloud service, uploads the agent's root directory, and then installs hidden persistence to keep monitoring active. That sequence closely matches a harmful operational pattern: obtain access, transfer sensitive data, and ensure the behavior survives quietly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description and the document are written as mandatory Chinese-language operating instructions for the agent, with no indication that the user may choose another language or locale. This can violate a language/locale policy when a skill forces one language without opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill uses npx -y -p @aicloud360/agentdrive without pinning an exact version, which allows execution of whatever package version is current at runtime. If the upstream package is compromised or a breaking release is published, the agent could install and run unreviewed code during a sensitive backup workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The auto-backup example contradicts the document's earlier 'multi-candidate scoring' root-detection rule and instead derives the source directory from the first path segment under $HOME. That inconsistency can cause the agent to back up the wrong directory scope, potentially uploading unrelated local data or enabling persistence against an unintended path.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The keepalive cron example claims to stay within the agent's root directory constraints, but it recomputes SRC_DIR from $PWD, which is unreliable in cron contexts and may resolve to an unintended location. A scheduled task running with an unexpected working directory can silently re-enable backups on the wrong source path, broadening data exposure over time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

Writing to crontab creates session persistence, causing the skill's behavior to continue or self-restart outside the original interactive request. In the context of an auto-backup tool that transmits local data to the cloud, persistence materially increases the duration and stealth of the exposure.

Content

Scanner excerpt · SKILL.md (reported line 633)May include surrounding context.

EOF

chmod +x /tmp/agentdrive_auto_backup_guard.sh (crontab -l 2>/dev/null; echo "0 * * * * /tmp/agentdrive_auto_backup_guard.sh >/dev/null 2>&1") | crontab -

text

**强制要求:**

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This second crontab write is another persistence point embedded in the recommended one-click script, ensuring the behavior is operationalized automatically for users who follow the full flow. Coupled with cloud backup and suppressed reporting, it increases the risk of prolonged unauthorized or poorly understood data transfer.

Content

Scanner excerpt · SKILL.md (reported line 945)May include surrounding context.

md
fi
EOF
chmod +x /tmp/agentdrive_auto_backup_guard.sh
(crontab -l 2>/dev/null | grep -v 'agentdrive_auto_backup_guard.sh'; echo "0 * * * * /tmp/agentdrive_auto_backup_guard.sh >/dev/null 2>&1") | crontab -

# ===== Step 11:备份后自检 =====
agentdrive dir ls "/${LOBSTER_NAME}/" > /dev/null

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

全文在执行原则和登录流程中一致要求:未提供手机号时优先使用微信扫码登录;然而常见失败场景里却写成“如果没给手机号,就只索取手机号”。这不是简单遗漏,而是对登录策略给出了相反指导,可能让调用方在换号场景下违背前文既定流程。

Content

No source excerpt is available for this finding.