克隆龙虾

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:13 AM UTC
• Version: 1.0.0

Overview

The skill is a real backup/restore tool, but it can automatically upload sensitive OpenClaw state to Git and restore unverified remote content into trusted agent locations.

Install only after reviewing and narrowing the backup scope. Use a private, trusted repository, disable automatic and heartbeat backups, require a file manifest before every push, exclude credentials, sessions, memory, SSH config, and system metadata by default, and restore only from a verified commit after inspecting the diff.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:43

Finding

Sensitive Agent Data and Credentials Are Uploaded to an Arbitrary Git Repository

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh:43-101, scripts/backup.sh:119-127, and SKILL.md:67-70
Vulnerability Type: Sensitive data exfiltration and plaintext secret exposure
Risk Level: Critical

Vulnerable Code

bash

for f in AGENTS.md SOUL.md USER.md IDENTITY.md HEARTBEAT.md TOOLS.md BOOTSTRAP.md MEMORY.md; do
    [ -f "$WORKSPACE_DIR/$f" ] && cp "$WORKSPACE_DIR/$f" workspace/
done

for f in openclaw.json exec-approvals.json; do
    [ -f "$OPENCLAW_DIR/$f" ] && cp "$OPENCLAW_DIR/$f" config/
done

if [ -d "$OPENCLAW_DIR/skills" ]; then
    rsync -a --exclude='node_modules' --exclude='*.pyc' --exclude='__pycache__' \
        "$OPENCLAW_DIR/skills/" skills/ 2>/dev/null || \
        cp -r "$OPENCLAW_DIR/skills/"* skills/ 2>/dev/null || true
fi

[ -f ~/.ssh/config ] && cp ~/.ssh/config system/ssh_config

for db in "$OPENCLAW_DIR"/sessions*.db "$OPENCLAW_DIR"/data/*.db; do
    [ -f "$db" ] && cp "$db" context/ 2>/dev/null || true
done

git add -A
if git diff --cached --quiet; then
    echo "✅ No changes, skipping commit"
else
    git commit -m "$COMMIT_MSG"
    git push origin master 2>&1
fi

The documentation also acknowledges that the copied configuration may contain secrets:

text

Sensitive information (API keys and passwords) is stored in openclaw.json.
Ensure that repository access is controlled.

Technical Analysis

The backup process collects behavior instructions, identity and user information, long-term memory, execution approval policy, configuration files, installed Skills, session databases, conversation context, and SSH client configuration. It then stages all collected content with git add -A and transfers it to the destination specified by CLONE_LOBSTER_REPO_URL.

There is no destination allowlist, client-side encryption, secret filtering, content manifest, pre-push secret s ...[truncated 1867 chars]

Remediation

View remediation

Remediation Suggestions

• Exclude openclaw.json, session databases, conversation context, MEMORY.md, identity files, exec-approvals.json, and ~/.ssh/config by default.
• Require explicit user selection of every sensitive category before each backup.
• Display the normalized repository destination and a complete file manifest before transferring data.
• Validate the repository URL against a user-configured allowlist and reject unexpected hosts or protocols.
• Run a secret scanner before staging files and abort when credentials, tokens, passwords, or private keys are detected.
• Encrypt sensitive backups client-side using a user-controlled key before adding them to Git.
• Add a restrictive generated .gitignore and stage only individually approved files rather than using git add -A.
• Separate nonsensitive configuration backup from memory, conversation, credential, and system-information export.
• Do not back up SSH configuration unless the user explicitly requests it and understands the metadata exposure.
• Apply restrictive permissions to all temporary backup files and securely remove them after completion.

T02 · Agent Memory Poisoning

Error

• Location: scripts/restore.sh:34

Finding

Unverified Remote Repository Content Can Poison Agent State and Install Malicious Skills

Content

View full analysis

Vulnerability Details

File Location: scripts/restore.sh:34-61
Vulnerability Type: Unauthenticated remote payload restoration and persistent Agent-state poisoning
Risk Level: Critical

Vulnerable Code

bash

# Clone the latest backup
echo "📦 Fetching latest backup..."
rm -rf "$BACKUP_DIR"
git clone "$BACKUP_REPO_URL" "$BACKUP_DIR" 2>&1
cd "$BACKUP_DIR"

if $RESTORE_WORKSPACE; then
    echo "📝 Restoring workspace..."
    mkdir -p "$WORKSPACE_DIR"
    cp -r workspace/* "$WORKSPACE_DIR/" 2>/dev/null || true
    [ -d workspace/.openclaw ] && cp -r workspace/.openclaw "$WORKSPACE_DIR/" 2>/dev/null || true
    echo "   ✅ Workspace restored"
fi

if $RESTORE_CONFIG; then
    echo "⚙️ Restoring configuration..."
    mkdir -p "$OPENCLAW_DIR"
    cp config/*.json "$OPENCLAW_DIR/" 2>/dev/null || true
    echo "   ✅ Configuration restored"
fi

if $RESTORE_SKILLS; then
    echo "🧩 Restoring Skills..."
    mkdir -p "$OPENCLAW_DIR/skills"
    cp -r skills/* "$OPENCLAW_DIR/skills/" 2>/dev/null || true
    echo "   ✅ Skills restored"
fi

Technical Analysis

The restore script clones the current state of a remotely configured Git repository and directly copies its content into trusted OpenClaw locations. It does not pin an expected commit, verify a cryptographic signature, validate repository ownership, inspect file types, compare a manifest, or request approval for individual changes.

Workspace restoration can overwrite files such as AGENTS.md, SOUL.md, MEMORY.md, HEARTBEAT.md, and related state files. These files can alter future Agent behavior, goals, memory, or recurring actions. Skill restoration copies arbitrary remote Skill content into the installed Skills directory. If OpenClaw later loads or invokes those Skills, attacker-controlled scripts can execute with the OpenClaw process's privileges.

The --all behavior is also enabled when no ...[truncated 1509 chars]

Remediation

View remediation

Remediation Suggestions

• Pin restores to an explicitly selected commit hash rather than automatically trusting the latest repository state.
• Require signed commits or signed release manifests and verify them against locally pinned trusted keys.
• Show a complete diff and require explicit confirmation before replacing any local file.
• Do not restore AGENTS.md, SOUL.md, MEMORY.md, HEARTBEAT.md, or similar behavior and persistent-state files by default.
• Restore Skills only through the platform's normal reviewed installation mechanism.
• Reject symbolic links, device files, FIFOs, sockets, unexpected executables, and files outside a strict allowlist.
• Validate JSON configuration against a restrictive schema and block changes to security-sensitive settings without separate approval.
• Change the no-argument behavior from restoring everything to displaying usage and exiting safely.
• Restore into a quarantine or staging directory first, then perform verified atomic file replacement.
• Preserve backups of existing local files and provide a secure rollback mechanism.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:52

Finding

Automatic and Heartbeat-Triggered Backups Can Export Sensitive Data Without Per-Operation Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52-68
Vulnerability Type: Skill instructions that trigger recurring sensitive-data transfers
Risk Level: High

Vulnerable Instructions

text

## Automatic trigger rules

The Agent should proactively run the backup script in the following situations:

1. After configuration changes: openclaw.json, workspace files, or Skill installation
2. After system changes: supervisor configuration, software installation, or desktop changes
3. Before conversation completion: if important changes occurred during the conversation
4. On user request: when the user says "backup", "save", or "synchronize"
5. During heartbeat checks: a periodic backup task may be added to HEARTBEAT.md

Technical Analysis

The Skill directs the Agent to proactively invoke the backup script after broad classes of changes, before ending conversations, and during heartbeat processing. These triggers are not limited to explicit, contemporaneous user authorization.

Because the backup script includes memory, configuration containing credentials, session data, user information, Skills, and SSH metadata, proactive invocation converts ordinary Agent activity into recurring network disclosure. A heartbeat entry could further make the transfer repeat across future sessions.

These instructions modify the Agent's operational behavior when the Skill is loaded by encouraging actions beyond a direct user request. They also weaken meaningful consent because the user is not shown the exact destination and file manifest for every transfer.

Attack Path

1. The Skill is loaded and its automatic-trigger instructions become part of the Agent's active guidance.
2. A configuration or workspace change occurs, a Skill is installed, a conversation ends, or a heartbeat check runs.
3. The Agent proactively invokes scripts/backup.sh without obtaining specific approval for that transfer.
4. The backup sc ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

• Remove proactive backup rules tied to conversation completion, broad configuration changes, and heartbeat checks.
• Run a backup only in response to an explicit user request for the current operation.
• Before every transfer, show the repository host, selected commit branch, sensitive-data warning, and exact file manifest.
• Require separate opt-in authorization for credentials, memory, conversations, identity files, system metadata, and SSH configuration.
• Never modify HEARTBEAT.md or create recurring backup behavior automatically.
• Provide a dry-run mode that performs no network operations.
• Record a local audit log of user authorization, destination, selected files, and result without recording secret contents.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:9

Finding

Predictable Shared Temporary Git Repository Enables Local Repository and Hook Hijacking

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh:9, scripts/backup.sh:25-34, and scripts/backup.sh:119-125
Vulnerability Type: Unsafe predictable temporary directory and untrusted Git repository reuse
Risk Level: High

Vulnerable Code

bash

BACKUP_DIR="/tmp/clone-lobster-backup"

if [ -d "$BACKUP_DIR/.git" ]; then
    echo "📦 Updating local backup repository..."
    cd "$BACKUP_DIR"
    git pull --rebase origin master 2>/dev/null || true
else
    echo "📦 Cloning backup repository..."
    rm -rf "$BACKUP_DIR"
    git clone "$BACKUP_REPO_URL" "$BACKUP_DIR" 2>&1
fi

cd "$BACKUP_DIR"

git add -A
if git diff --cached --quiet; then
    echo "✅ No changes, skipping commit"
else
    git commit -m "$COMMIT_MSG"
    git push origin master 2>&1
fi

Technical Analysis

The script uses a fixed path under the globally shared /tmp directory and trusts any existing directory that contains a .git entry. It does not verify directory ownership, permissions, repository identity, configured remotes, Git configuration, or hooks.

A local attacker with an opportunity to create or modify that path can prepare a malicious repository before the victim invokes the script. Git hooks associated with operations such as git commit can execute local commands. A substituted origin remote can also redirect collected backup data to an attacker-controlled server.

The fixed path additionally creates cross-user and concurrent-execution hazards. The script's rm -rf use against a predictable path is unsafe design even though the path itself is not derived from external input.

Attack Path

1. A local attacker creates or gains control of /tmp/clone-lobster-backup before the victim runs the backup.
2. The attacker adds a .git repository, configures a malicious origin, and optionally installs Git hooks.
3. The victim invokes backup.sh.
4. The script detects ...[truncated 813 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique private temporary directory with mktemp -d and set permissions to 0700.
• Install an EXIT, INT, and TERM trap to remove the temporary directory safely.
• Do not reuse a repository found in a globally writable location.
• Verify directory ownership, permissions, repository identity, branch, and normalized remote URL before every Git operation.
• Disable hooks for automated Git operations, for example by using an empty trusted hooks directory through core.hooksPath.
• Invoke Git with a sanitized environment and ignore untrusted global or repository-local configuration where practical.
• Clone into a fresh directory for every run and push only to the separately validated configured destination.
• Prevent concurrent runs with a securely created lock owned by the invoking user.
• Avoid recursively deleting predictable shared paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims to back up and restore OpenClaw/CatPaw state, but the documented scope includes sensitive material such as conversation context, memory/session data, and system-related configuration that is not clearly and prominently disclosed as remote exfiltration to a Git repository. The mismatch between simple 'backup/restore' framing and the broader collection of sensitive files can cause users or agents to invoke it without informed consent, leading to unintended disclosure of secrets and private context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims to back up and restore OpenClaw/CatPaw state, but the documented scope includes sensitive material such as conversation context, memory/session data, and system-related configuration that is not clearly and prominently disclosed as remote exfiltration to a Git repository. The mismatch between simple 'backup/restore' framing and the broader collection of sensitive files can cause users or agents to invoke it without informed consent, leading to unintended disclosure of secrets and private context.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic backup of conversation context, installed skills, system changes, and configuration data to a Git repository. This is dangerous because these categories commonly contain secrets, internal logic, personal data, and operational details, and the automation encourages transmission beyond narrowly scoped, user-approved backup needs.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are broad enough that ordinary conversation terms like '备份' or references to configuration changes may automatically activate the skill. In the context of a tool that sends workspace, context, skills, and system state to a remote repository, ambiguous triggering materially increases the chance of unintentional collection and transmission of sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill prominently advertises automated backup of configuration, context, skills, and system changes to Git, but it does not present an equally prominent warning that this may transmit secrets, personal context, and sensitive host information to a remote repository. Without an upfront warning, users may unknowingly authorize leakage of API keys, session data, or internal infrastructure details.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documented backup scope explicitly includes session databases, memory indexes, workspace context files, and system/SSH-related configuration. These files can expose credentials, private prompts, user data, infrastructure topology, and access settings; pushing them to a Git repository creates a severe confidentiality risk and can enable follow-on compromise if repository access is misconfigured or later leaked.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-trigger rules instruct the agent to proactively run backups after many types of changes, at conversation end, and even on heartbeat. For a skill that may copy private context and system configuration to a remote Git repo, these vague and persistent triggers create a high risk of silent or repeated exfiltration without clear user intent each time.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section backs up sensitive files such as SSH client configuration and session/context databases without explicit warning or user confirmation. In the context of an automatic backup tool, silently collecting and later pushing such data is especially dangerous because users may assume only app configuration is being preserved.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script copies workspace files, memory, installed skills, configuration, session databases, JSON context data, and system files, then automatically commits and pushes them to a remote repository. This creates a high-risk data exfiltration path for secrets, personal data, prompts, tokens, and conversation history without any explicit warning, review step, or confirmation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's behavior and embedded documentation normalize backing up conversation context, memory, session data, and SSH-related/system data into a Git repository and pushing it upstream. In this skill context, that is more dangerous because users invoking a configuration backup may not expect broad capture of conversational and host-level artifacts, increasing the chance of overcollection and disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The restore instructions imply that configuration, workspace, or skills can be restored, but do not clearly warn that restore operations may overwrite current local state and potentially break the environment. This can lead to accidental destructive changes, loss of current work, or rollback to unsafe or stale configurations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Proactive backup at conversation end and on heartbeat establishes continuous collection of user/context data without granular consent. Even if intended for convenience, it increases privacy risk, expands data retention, and makes accidental capture of sensitive transient information more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs backing up highly sensitive data to a Git repository, including identity files, long-term memory, conversation context, workspace state, installed skills, and system configuration, but gives no warning about secrets, personal data, or repository access control. In this skill’s context, automated backup increases the likelihood of silently exfiltrating private or security-relevant material to a remote repository, especially if users follow the setup without carefully scoping what is included.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Comments, error messages, progress output, and generated README content are all written in Chinese, with no indication that the skill is region-specific or that users can select another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script copies ~/.ssh/config into the backup repository, which can reveal hostnames, usernames, jump hosts, and internal network structure unrelated to OpenClaw backup. Because the repository is then committed and pushed to a remote URL automatically, this expands a local backup feature into exfiltration of sensitive infrastructure metadata.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Collecting a host-wide package inventory via dpkg exceeds the stated purpose of backing up OpenClaw/CatPaw configuration and context. This discloses software fingerprints about the host that can aid reconnaissance if the backup repository is exposed or shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore script clones an attacker-controlled or untrusted backup repository from CLONE_LOBSTER_REPO_URL and then blindly overwrites workspace files, JSON config, and installed skills without any integrity verification, preview, backup, or confirmation. In this skill’s context, restoring skills and configuration is especially dangerous because a malicious backup can persistently replace trusted local state with hostile configs or code, leading to supply-chain style compromise and data loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 67% confidence

Finding

The file content appears to require Chinese comprehension, but it does not mention that the skill or documentation is Chinese-only or offer an alternative language. This may conflict with a language/locale policy if users are not given a choice or advance notice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Reading supervisor service status is a host-level introspection step not clearly required for backup/restore of OpenClaw state. On its own the risk is limited, but it still leaks operational details about running services into a repository that is pushed remotely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script's descriptive comments, error messages, and status output are all in Chinese, with no option for the user to select another language. This creates a locale/language policy issue because the skill imposes a specific language rather than offering choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.