Openclaw Backup 1.0.0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

This backup skill is mostly purpose-aligned, but it handles credentials and session data with weak safeguards and includes destructive restore commands users could copy directly.

Install only if you are comfortable creating full OpenClaw backups that may include API keys, tokens, sessions, workspace memory, user files, and scheduled tasks. Store backups in an owner-only, trusted directory, consider encrypting them, and review restore commands carefully before running them because they can overwrite or delete current OpenClaw state.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:4

Finding

Sensitive credential backups are created without enforced access controls

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh, lines 4–11
Vulnerability Type: Sensitive data exposure through insecure file permissions
Risk Level: High

bash

BACKUP_DIR="${1:-$HOME/openclaw-backups}"
DATE=$(date +%Y-%m-%d_%H%M)
BACKUP_FILE="$BACKUP_DIR/openclaw-$DATE.tar.gz"

mkdir -p "$BACKUP_DIR"

# Create backup (exclude completions cache and logs)
tar -czf "$BACKUP_FILE" \
    --exclude='completions' \

Technical Analysis

The script archives the user's complete .openclaw directory. According to SKILL.md, this includes API keys, tokens, authentication profiles, Telegram session data, agent state, user files, and scheduled tasks.

Neither the backup directory nor the generated archive is assigned an explicit restrictive permission mode. The script does not set a secure umask, use mkdir with mode 700, or apply mode 600 to the archive. Consequently, actual permissions depend on the caller's inherited environment and the permissions of an existing destination directory.

If the script runs with a permissive umask, or if the caller supplies a shared or inadequately protected backup directory, another local user may be able to list or read the unencrypted archive. The archive itself is compressed but not encrypted, so compression provides no confidentiality.

Attack Path

1. A user or automated task invokes backup.sh under a permissive umask, or specifies an inadequately protected shared directory as backup_dir.
2. The script creates the directory and archive without enforcing owner-only permissions.
3. Another local account discovers the generated openclaw-*.tar.gz file.
4. That account reads and extracts the archive.
5. The attacker obtains credentials, API tokens, Telegram session material, configuration, agent state, and user workspace data.

Exploitation requires local access and effective read permission to the generated archive; the script does not ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

• Set umask 077 at the beginning of the script, before creating the destination directory or archive.
• Create the destination with mkdir -p -m 700 -- "$BACKUP_DIR" and explicitly enforce chmod 700 -- "$BACKUP_DIR" when appropriate.
• Create the archive with owner-only access and run chmod 600 -- "$BACKUP_FILE" after successful creation.
• Validate that the destination is a directory owned by the current effective user and is not a symbolic link or an unexpectedly shared location.
• Refuse destinations that are group-writable or world-writable unless an explicit secure-use policy supports them.
• Consider authenticated encryption for archives because they contain long-lived credentials and session data. Encryption keys should be stored separately from the backups.
• Write to a securely created temporary file in the destination, verify successful archive creation, apply permissions, and then atomically rename it to the final filename.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.sh:16

Finding

Backup rotation performs unsafe filename parsing through ls and xargs

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh, lines 16–20
Vulnerability Type: Unsafe filename handling during destructive file rotation
Risk Level: Medium

bash

if [ $? -eq 0 ]; then
    SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

Technical Analysis

The rotation logic parses human-oriented ls output and passes it to xargs, which uses whitespace as an argument delimiter by default. POSIX filenames can contain spaces, tabs, and newline characters. A matching filename containing such characters can therefore be split into multiple operands rather than treated as one path.

The resulting operands are passed directly to rm without an explicit -- end-of-options marker. This construction can delete unintended files, fail to remove the intended archive, or leave old archives containing credentials beyond the documented seven-backup retention limit.

Exploitation depends on an attacker or another process being able to create crafted entries in the selected backup directory. This becomes more plausible when a caller supplies a shared or attacker-writable destination, which the script currently does not reject.

Attack Path

1. The script is configured to use a backup directory in which an attacker or untrusted process can create files.
2. The attacker creates crafted entries matching openclaw-*.tar.gz, using whitespace or newline characters to manipulate argument boundaries.
3. At least eight matching archives or entries exist, causing the crafted output to reach the rotation stage after tail -n +8.
4. The next successful backup invokes the ls | tail | xargs rm pipeline.
5. xargs splits the crafted filename into unintended arguments.
6. rm deletes unintended accessible paths, ...[truncated 807 chars]

Remediation

View remediation

Remediation Suggestions

• Do not parse ls output or pass newline-delimited filenames to xargs.
• Collect matching files using a filename-safe mechanism, sort them using explicit metadata, and store results in a shell array.
• Delete selected entries using rm -- "${files[@]}" so each filename remains one argument and option parsing is terminated.
• Where external pipelines are necessary, use null-delimited output and input throughout, such as compatible find -print0, sorting, and xargs -0 operations.
• Validate that every rotation candidate is a regular file directly within the expected backup directory.
• Verify that the backup directory is owned by the current user and is not writable by untrusted users.
• Enable strict shell behavior, such as set -euo pipefail, and check rotation errors rather than silently suppressing them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code clearly performs backup creation and backup rotation for the ~/.openclaw directory with exclusions, which aligns with part of the description. However, the declared purpose also says the skill can restore from backup and set up automatic backup schedules, and no such behavior exists in the provided code. Because those are significant declared capabilities rather than minor implementation details, the description overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The command rm -rf ~/.openclaw permanently deletes the active OpenClaw state and can cause irreversible data loss if the backup directory is missing, stale, or misnamed. In a restore skill that handles credentials, agent configs, workspace data, and scheduled tasks, this is especially sensitive because users may execute the command without validating the rollback source first.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The command rm -rf ~/.openclaw permanently deletes the active OpenClaw state and can cause irreversible data loss if the backup directory is missing, stale, or misnamed. In a restore skill that handles credentials, agent configs, workspace data, and scheduled tasks, this is especially sensitive because users may execute the command without validating the rollback source first.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The rotation pipeline uses ls ... | tail ... | xargs rm, which is unsafe because filenames are parsed through whitespace-delimited text processing before being passed to rm. If an attacker can place specially crafted filenames in the backup directory, this can cause unintended deletion behavior or make rm interpret filenames as options, especially since the user-controlled BACKUP_DIR argument widens the attack surface.

Content

Scanner excerpt · scripts/backup.sh (reported line 21)May include surrounding context.

sh

SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill is specifically designed to persist and restore session-related material, including credentials, auth profiles, workspace memory, and telegram session data. In context, that persistence is intentional for backup purposes, but it still increases security risk because compromising the backup yields durable access tokens and conversation/session state.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
---

# OpenClaw Backup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to back up credentials, API keys, tokens, session data, and workspace files, but it does not warn that the resulting archive is highly sensitive. A backup tarball containing secrets can be copied, exfiltrated, or stored insecurely, effectively concentrating all access material into a single high-value artifact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore procedure replaces the active ~/.openclaw directory and extracts archived contents over the home directory without a prominent warning about overwriting current state. This can destroy newer data, reintroduce stale credentials or compromised configurations, and cause accidental rollback of security-relevant files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rollback section contains destructive recovery steps but does not explicitly warn that the current ~/.openclaw directory will be permanently deleted before restoration. In a backup/restore skill, users are likely to copy-paste commands directly, so omission of a clear data-loss warning increases the chance of accidental destruction of newer or unrecoverable state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script deletes backup archives beyond the most recent seven using rm, which is a destructive operation. Although the script prints messages after completion, there is no warning beforehand, confirmation prompt, or comment near usage indicating that running the script will remove older backups automatically.

Content

No source excerpt is available for this finding.