openclaw-backup-guide

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:57 PM UTC
• Version: 1.0.0

Overview

This backup skill performs purpose-related backup tasks, but it can repeatedly send broad workspace contents to hard-coded remote destinations and push all repository changes without adequate scoping or user review.

Review this carefully before installing. Do not enable the cron/OpenClaw schedule as written. Replace hard-coded paths and remote hosts, limit backups to explicit approved files, exclude secrets and databases unless intentionally protected, avoid git add -A for automated pushes, and verify where NAS or cloud sync will store long-lived copies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: backup-nas.sh:2

Finding

Overbroad workspace collection and transfer to a hard-coded external destination

Content

View full analysis

/dev/null scp -O /tmp/orbital-backup.tar.gz "$NAS:$DEST/orbital-workspace.tar.gz" 2>/dev/null # Also send the clean DB copy separately for easy access scp -O "$SRC/projects/the-orbital/data/orbital-backup.db" "$NAS:$DEST/orbital-backup.db" 2>/dev/null ``` ### Technical Analysis The script archives nearly the entire hard-coded workspace, excluding only `node_modules`, `.next`, and `.git`. It does not exclude common sensitive resources such as `.env` files, API tokens, SSH material, application credentials, logs, private configuration, or unrelated project data. The resulting archive and database are sent through SCP to the hard-coded account `lstone@192.168.4.95`. The comment also states that the NAS uses Cloud Sync to replicate data to Google Drive. This behavior conflicts with the documentation, which presents NAS backup as optional and instructs users to configure their own NAS path. The collection scope is broader than necessary to back up the identified SQLite database or a specifically approved project. The destination is tied to the author's apparent environment instead of being explicitly selected and verified by the operator. ### Attack Path 1. The user installs the documented hourly cron or OpenClaw scheduled task. 2. The schedu ...[truncated 1103 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:28

Finding

Recurring Git commands can publish unrelated secrets and workspace content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: backup-nas.sh:11

Finding

Predictable shared temporary archive enables local race and file-clobber attacks

Content

View full analysis

/dev/null scp -O /tmp/orbital-backup.tar.gz "$NAS:$DEST/orbital-workspace.tar.gz" 2>/dev/null # Also send the clean DB copy separately for easy access scp -O "$SRC/projects/the-orbital/data/orbital-backup.db" "$NAS:$DEST/orbital-backup.db" 2>/dev/null rm -f /tmp/orbital-backup.tar.gz ``` ### Technical Analysis The script uses the fixed path `/tmp/orbital-backup.tar.gz` in a shared temporary directory. It neither creates the file atomically nor verifies its ownership and type before writing or transferring it. A local user who can manipulate that path may pre-create it, substitute a symbolic link where platform protections permit, or replace the archive between creation and SCP. This can cause the process to overwrite a file writable by the invoking account or transfer attacker-selected/stale data instead of the intended backup. The practical severity depends on operating-system temporary-file protections, process permissions, and whether an attacker has local access. The fixed name nevertheless violates secure temporary-file practices. ### Attack Path 1. A local attacker predicts the constant `/tmp/orbital-backup.tar.gz` path. 2. Before execution, the attacker creates or manipulates that path, or monitors it for replacement during execution. 3. The backup process writes through the manipulated path or creates the archive. 4. The attacker races the interval between archive creation and SCP and replaces the file. 5. The process may overwrite another file within its permissions or upload attacker-controlled content to the NAS. ### Impact Assessment Potential impact includes integrity loss for files writable by the scheduled-task account, corruption of backup output ...[truncated 313 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: backup-nas.sh:11

Finding

Suppressed errors and unconditional success reporting conceal backup failures

Content

View full analysis

/dev/null scp -O /tmp/orbital-backup.tar.gz "$NAS:$DEST/orbital-workspace.tar.gz" 2>/dev/null # Also send the clean DB copy separately for easy access scp -O "$SRC/projects/the-orbital/data/orbital-backup.db" "$NAS:$DEST/orbital-backup.db" 2>/dev/null rm -f /tmp/orbital-backup.tar.gz echo "✅ NAS backup complete" ``` The documented crontab command also separates the database backup from later operations with a semicolon: ```bash 0 * * * * cd /path/to/workspace && node scripts/backup-db.js; bash scripts/backup-nas.sh; git add -A && git commit -m "Hourly backup: $(date '+%Y-%m-%d %H:%M %Z')" && git push origin main ``` ### Technical Analysis Errors from archive creation and both SCP operations are redirected to `/dev/null`. Their exit statuses are not checked, and the script subsequently executes `rm` and an unconditional success message. Because `echo` normally exits successfully, the overall script can report a successful status even when no archive was created or no data reached the NAS. In the first documented cron command, the semicolon after `backup-db.js` allows `backup-nas.sh` to run even if the database backup fails. The NAS script's false success status may then permit later Git commands to continue. This behavior undermines the integrity and availability guarantees expected from backup software. ### Attack Path 1. Archive creation or SCP fails because of a missing source, permissions, disk exhaustion, network failure, authentication failure, or destination error. 2. The underlying diagnostic message is discarded through `2>/dev/null`. 3. The script does not test the failed command's exit status. 4. The script prints `NAS backup com ...[truncated 798 chars]

Remediation

View remediation

/dev/null` suppression; write errors to a protected log or monitoring system. - Print success only after all required operations complete and are verified. - Use `&&` or a structured script so later stages do not execute after an earlier failure. - Verify archive existence, type, size, and integrity before transfer. - Verify the remote artifact after transfer, preferably with a cryptographic checksum. - Return a nonzero exit status on every failure path. - Configure cron or OpenClaw monitoring to alert on nonzero status and missed backup intervals. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- `SKILL.md` - This file (usage guide)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · backup-nas.sh (reported line 23)May include surrounding context.

sh

# Also send the clean DB copy separately for easy access
scp -O "$SRC/projects/the-orbital/data/orbital-backup.db" "$NAS:$DEST/orbital-backup.db" 2>/dev/null

rm -f /tmp/orbital-backup.tar.gz

echo "✅ NAS backup complete"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes automated database backups, NAS sync, and GitHub pushes as routine workflow but does not warn that backups may contain sensitive data and will be transmitted to external destinations or overwrite prior state. In a backup skill, this omission is security-relevant because users may enable cron-based exfiltration of workspace contents to a remote repo or shared storage without understanding confidentiality, retention, or recovery risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script automatically exfiltrates a full workspace archive and a database file to a remote NAS over the network with no confirmation, logging, or guardrails. Even though SCP uses SSH, the operation still transfers potentially sensitive source code and data to another system silently, which is risky in an agent skill context because users may not realize broad data movement is occurring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script removes /tmp/orbital-backup.tar.gz after creating and transmitting a full workspace backup. While cleanup is expected, this is still a file deletion operation and the script provides no user-facing notice that the temporary archive will be created and then deleted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.