T09 · Insecure Skill Coding Practices
- Location
references/backup.md:5- Finding
Unencrypted Backups May Expose Feishu Credentials and Agent Data
- Content
View full analysis
Vulnerability Details
File Location:
references/backup.md:5-10andreferences/backup.md:41-46
Related Sensitive Configuration:SKILL.md:29-32andreferences/config-fields.md:53-65
Vulnerability Type: Plaintext storage of sensitive backup data
Risk Level: MediumVulnerable Code Snippets
references/backup.md:5-10:bash # Back up the configuration file cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.$(date +%Y%m%d) # Back up the entire configuration directory tar -czf ~/openclaw-backup-$(date +%Y%m%d).tar.gz ~/.openclaw/references/backup.md:41-46:bash # Back up all Agent workspaces for i in 1 2 3 4; do tar -czf ~/workspace${i}-backup-$(date +%Y%m%d).tar.gz \ ~/.openclaw/workspace${i}/ doneThe archived configuration contains sensitive Feishu credentials as documented in
references/config-fields.md:53-65:json { "channels": { "feishu": { "accounts": { "main": { "appId": "cli_xxx", "appSecret": "xxx" } } } } }Technical Analysis
The backup procedure creates unencrypted copies of the complete OpenClaw configuration directory and Agent workspaces. The configuration is expected to contain Feishu application secrets under
channels.feishu.accounts, while Agent workspaces may contain state, memory, conversation-derived information, configuration, or other private files.The instructions do not establish a restrictive
umask, explicitly set archive permissions, encrypt the resulting archives, exclude unnecessary sensitive content, or define secure retention and deletion requirements. Consequently, the effective permissions of the generated files depend on the user's environment. The resulting archives may also be captured by home-directory synchronization, endpoint backup software, or unrelated processes with access to the user's files.Compression with
tar -czfdoes not provide encryption or access control. It creates ...[truncated 1898 chars]- Remediation
View remediation
Remediation Suggestions
- Apply restrictive permissions before creating any backup:
bash umask 077- Back up only the files required for restoration rather than archiving the entire
~/.openclaw/directory. - Exclude credentials, logs, temporary files, memory, and other sensitive runtime data unless they are explicitly required.
- Encrypt backups with authenticated encryption using a reviewed tool such as
age, GPG, or an approved enterprise backup solution. - Keep encryption keys separate from the backup files and protect them using an operating-system credential store, hardware-backed key store, or managed secret service.
- Store Feishu application secrets in a supported secret manager or protected environment mechanism instead of plaintext configuration where possible.
- Explicitly restrict backup permissions after creation:
bash chmod 600 ~/openclaw-backup-*.tar.gz chmod 600 ~/workspace*-backup-*.tar.gz- Define backup retention and secure-deletion policies to prevent obsolete credentials from remaining recoverable indefinitely.
- Rotate Feishu application secrets after any suspected archive disclosure.
- Document a secure restoration procedure that preserves restrictive ownership and permissions and does not leave temporary plaintext copies behind.