T09 · Insecure Skill Coding Practices
Error
- Location
- healthy-backup.sh:58
- Finding
- Raw OpenClaw Configuration Is Included in Migratable and Full Backups## Vulnerability Details **File Location**: `healthy-backup.sh:58-62, 188-193, 222-230` **Vulnerability Type**: Sensitive data exposure caused by incomplete backup exclusions **Risk Level**: High **Vulnerable Code:** ```bash EX=(--exclude=shared/secrets/ --exclude=credentials/ --exclude='*.key' --exclude='*.pem' --exclude='*.env' --exclude='*.secret' --exclude='.env' --exclude='.git/' --exclude='node_modules/' --exclude='BACKUPS/') ``` ```bash sync_dir() { local s="$1" d="$STAGING/$2" shift 2 mkdir -p "$d" rsync -a "${EX[@]}" "$@" "$s/" "$d/" } stage_config() { mkdir -p "$STAGING/config" jq 'walk(if type=="object" then with_entries( if (.key|test("password|token|secret|key";"i")) then .value="<redacted>" else . end) else . end )' "$OC_CFG" > "$STAGING/config/openclaw.json" ok "openclaw.json (scrubbed)" } ``` ```bash case "$TIER" in migratable) stage_config sync_dir "$OC" openclaw --exclude='logs/' --exclude='media/' --exclude='browser/' ok "~/.openclaw"; stage_deps ;; full) stage_config sync_dir "$OC" openclaw --exclude='logs/' --exclude='media/' --exclude='browser/' ok "~/.openclaw"; stage_deps [ -d "$WORKSPACE" ] && { sync_dir "$WORKSPACE" workspace --exclude='canvas/'; ok "workspace"; } || warn "workspace not found" [ -d "$SKILLS" ] && { sync_dir "$SKILLS" skills --exclude='.venv/'; ok "skills"; } || warn "skills not found" ;; esac ``` ### Technical Analysis `stage_config` correctly creates a scrubbed copy at `config/openclaw.json`. However, the migratable and full tiers then recursively synchronize the entire `~/.openclaw` directory into `openclaw/`. The exclusion list removes credential directories and selected filename patterns, but it does not exclude the root-level `openclaw.json`. Consequently, the archive can contain both: - `config/op ...[truncated 1772 chars]
- Remediation
- ## Remediation Suggestions 1. Explicitly exclude the source configuration when synchronizing `~/.openclaw`: ```bash sync_dir "$OC" openclaw \ --exclude='/openclaw.json' \ --exclude='logs/' \ --exclude='media/' \ --exclude='browser/' ``` 2. Keep only the scrubbed `config/openclaw.json` in the archive. 3. Apply the exclusion as a source-root-relative rule so similarly named nested files are not unintentionally affected. 4. Add automated tests for every backup tier that decrypt the resulting archive and assert: - No `openclaw/openclaw.json` exists. - Exactly one intended scrubbed configuration copy exists. - Known test secrets do not appear anywhere in extracted archive content. 5. Treat backups created by affected versions as potentially containing raw credentials. Rotate sensitive credentials and securely delete or replace affected local and remote archives. 6. Update release checksums and documentation after publishing the corrected script.