T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/backup.sh:43
- Finding
- Sensitive Agent Data and Credentials Are Uploaded to an Arbitrary Git Repository## Vulnerability Details **File Location**: `scripts/backup.sh:43-101`, `scripts/backup.sh:119-127`, and `SKILL.md:67-70` **Vulnerability Type**: Sensitive data exfiltration and plaintext secret exposure **Risk Level**: Critical ### Vulnerable Code ```bash for f in AGENTS.md SOUL.md USER.md IDENTITY.md HEARTBEAT.md TOOLS.md BOOTSTRAP.md MEMORY.md; do [ -f "$WORKSPACE_DIR/$f" ] && cp "$WORKSPACE_DIR/$f" workspace/ done for f in openclaw.json exec-approvals.json; do [ -f "$OPENCLAW_DIR/$f" ] && cp "$OPENCLAW_DIR/$f" config/ done if [ -d "$OPENCLAW_DIR/skills" ]; then rsync -a --exclude='node_modules' --exclude='*.pyc' --exclude='__pycache__' \ "$OPENCLAW_DIR/skills/" skills/ 2>/dev/null || \ cp -r "$OPENCLAW_DIR/skills/"* skills/ 2>/dev/null || true fi [ -f ~/.ssh/config ] && cp ~/.ssh/config system/ssh_config for db in "$OPENCLAW_DIR"/sessions*.db "$OPENCLAW_DIR"/data/*.db; do [ -f "$db" ] && cp "$db" context/ 2>/dev/null || true done git add -A if git diff --cached --quiet; then echo "✅ No changes, skipping commit" else git commit -m "$COMMIT_MSG" git push origin master 2>&1 fi ``` The documentation also acknowledges that the copied configuration may contain secrets: ```text Sensitive information (API keys and passwords) is stored in openclaw.json. Ensure that repository access is controlled. ``` ### Technical Analysis The backup process collects behavior instructions, identity and user information, long-term memory, execution approval policy, configuration files, installed Skills, session databases, conversation context, and SSH client configuration. It then stages all collected content with `git add -A` and transfers it to the destination specified by `CLONE_LOBSTER_REPO_URL`. There is no destination allowlist, client-side encryption, secret filtering, content manifest, pre-push secret s ...[truncated 1867 chars]
- Remediation
- ## Remediation Suggestions - Exclude `openclaw.json`, session databases, conversation context, `MEMORY.md`, identity files, `exec-approvals.json`, and `~/.ssh/config` by default. - Require explicit user selection of every sensitive category before each backup. - Display the normalized repository destination and a complete file manifest before transferring data. - Validate the repository URL against a user-configured allowlist and reject unexpected hosts or protocols. - Run a secret scanner before staging files and abort when credentials, tokens, passwords, or private keys are detected. - Encrypt sensitive backups client-side using a user-controlled key before adding them to Git. - Add a restrictive generated `.gitignore` and stage only individually approved files rather than using `git add -A`. - Separate nonsensitive configuration backup from memory, conversation, credential, and system-information export. - Do not back up SSH configuration unless the user explicitly requests it and understands the metadata exposure. - Apply restrictive permissions to all temporary backup files and securely remove them after completion.