OpenClaw Backup Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 1.0.1

Overview

This backup skill is mostly purpose-aligned, but its restore and git-sync behavior creates real safety and disclosure risks that users should review before installing.

Install only if you are comfortable with a backup tool that reads broad OpenClaw data, writes archives under ~/backups, and can overwrite files during restore. Avoid enabling git sync unless the target repository is dedicated to backups and you have reviewed exactly what will be committed. Do not restore untrusted or manually named archives, and treat the restore command as unsafe until it validates names and avoids shell command construction.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.js:104

Finding

Shell Command Injection Through a User-Controlled Backup Name

Content

View full analysis

`. 3. The crafted argument passes the file-existence check. 4. The embedded quote terminates the shell-quoted archive path. 5. The shell interprets the injected metacharacters and executes attacker-selected commands. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the Skill. This can permit reading or modifying OpenClaw files, stealing credentials, deleting data, altering configuration, or establishing additional persistence. It does not directly provide elevated operating-system privileges beyond those of the ...[truncated 24 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.js:55

Finding

Shell Injection Through an Unquoted Home Directory Environment Variable

Content

View full analysis

/dev/null`, { stdio: 'pipe' }); ``` The same unsafe interpolation occurs during restore: ```javascript execSync(`tar -xzf "${p}" -C ${process.env.HOME || process.env.USERPROFILE}`, { stdio: 'inherit' }); ``` ### Technical Analysis The script inserts `HOME` or `USERPROFILE` directly into shell command strings without quoting or escaping it. A path containing spaces will be split into multiple arguments. More seriously, if the execution environment can be influenced, shell metacharacters in the environment value are interpreted as command syntax. Environment variables are commonly trusted but are process inputs rather than reliable security boundaries. The script should not assume that they contain shell-safe data. ### Attack Path 1. An attacker controls or influences the environment used to launch the Skill, such as through a wrapper, task definition, compromised process, or manually crafted invocation. 2. The attacker supplies a `HOME` or `USERPROFILE` value containing shell metacharacters and an injected command. 3. The user or Agent invokes either the backup or restore operation. 4. `execSync` passes the constructed string to a shell. 5. The shell interprets the malicious environment value and executes the injected command. ### Impact Assessment Exploitation allows arbitrary commands to run with the privileges of the account invoking the Skill. The attacker could access OpenClaw configuration, modify files available to that account, read credentials, or destroy backups. Ordinary home paths containing spaces may also cause backup or restore failures even without malicious exploitation. ]]>

Remediation

View remediation

/dev/null`; configure `stdio` through the Node.js API instead. - Apply the argument-array approach consistently to every external command. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/backup.js:84

Finding

Opt-In Git Sync Commits and Pushes the Entire Workspace

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises operational commands and environment-affecting behavior but does not declare any explicit tool scope or permission boundary. That makes it harder for a host system or reviewer to constrain execution, increasing the chance the skill is invoked with broader filesystem or environment access than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes broad everyday terms like "save" and "export," which can cause the skill to activate in contexts unrelated to backups. Unintended invocation is risky here because the skill discusses destructive restore flows and persistent backup configuration, so an agent may surface or initiate sensitive actions too readily.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The first-use suggestion logic uses ambiguous conditions and broad phrases to proactively offer backup setup. This increases the likelihood of the skill steering ordinary conversations toward enabling persistence features like scheduled backups or git sync, even when the user intent is not clearly administrative.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The skill contains guidance for automatically running backups on a schedule, which is autonomous behavior persisting beyond the current session. Although framed as opt-in, scheduled execution can still create risk if enabled without strong confirmation, because it changes system state and may continue collecting sensitive data over time.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

Enable Periodic Backup (Daily)

To automatically run backups daily at 2 AM:

bash

# Add to crontab

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Editing crontab establishes session persistence by causing the backup script to run indefinitely on a schedule. In the context of a skill that can archive skills, memory, configs, and optionally credentials, persistence materially increases the blast radius of any misconfiguration or later abuse.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash

# Add to crontab
crontab -e
# Add this line:
0 2 * * * cd ~/.openclaw/workspace && node skills/backup-automation/scripts/backup.js >> ~/.logs/openclaw-backup.log 2>&1

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description says backups of cron jobs are supported and that periodic scheduling is opt-in only. However, the default backup set always includes .openclaw-cron.json, which is itself cron job configuration data, regardless of whether periodic backup opt-in is enabled. That creates a mismatch between the claimed opt-in scope around scheduling-related data and the code's default behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The stated purpose centers on backing up OpenClaw instances with local tar archives, while git sync is only briefly mentioned as opt-in. The code implements repository mutation and network-capable synchronization via git commit and git push, which is a broader capability than simple local backup and can publish workspace contents remotely. Even though opt-in gated, this is a materially different capability from local archive creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The restore path extracts an archive directly into the user's home directory without confirmation, preview, or path validation. This can overwrite existing files and, if a malicious or tampered archive is restored, write attacker-controlled content into sensitive locations under the home directory.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup.js (reported line 133)May include surrounding context.

js

function suggestPeriodic() {
  console.log('\n💡 To enable daily automatic backups:');
  console.log('   crontab -e');
  console.log('   Add: 0 2 * * * cd ~/.openclaw/workspace && node skills/backup-automation/scripts/backup.js');
}