Security audit

OpenClaw Self Backup & Restore

Security checks for vulnerabilities and agentic risk

Overview

This is a real backup and restore skill, but it creates unencrypted archives of sensitive OpenClaw secrets and restores archives unsafely.

Review before installing. Treat every backup archive as a secret: encrypt it, keep it out of shared or synced locations unless protected, restore only archives you created and trust, and avoid enabling the cron example until retention, removal, and secrets handling are clear.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup.py:21
Finding: Unencrypted backups expose API credentials and other sensitive agent data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/restore.py:41
Finding: Unvalidated tar extraction permits path traversal and unsafe archive entries
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/restore.py:26
Finding: Pre-restore snapshot captures the entire OpenClaw directory beyond the declared scope
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/restore.py:55
Finding: Recovery instructions install unpinned third-party dependencies
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Note

Location: SKILL.md:53
Finding: Optional scheduled backup repeatedly processes secrets and announces activity externally
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises full backup/restore and auto-backup behavior, but the markdown only documents commands and a narrower hardcoded backup scope, with important implementation details absent. This mismatch can mislead users and reviewers about what is actually backed up, restored, or scheduled, increasing the chance of unsafe assumptions around disaster recovery and sensitive data handling.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Including .openclaw/.env in the backup captures environment secrets such as API keys, tokens, or service credentials. In a self-backup skill, this materially increases exposure because backups are likely to be copied, synced, or retained outside the original protected environment, turning routine backup handling into credential disclosure risk.
Content: Scanner excerpt · scripts/backup.py (reported line 24)May include surrounding context.
python
BACKUP_PATHS = [ # 核心配置 ".openclaw/openclaw.json", ".openclaw/.env", ".openclaw/cron/jobs.json", # 凭证（加密存储，备份后需妥善保管） ".openclaw/credentials",

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The restore logic extracts every archive member directly into the user's home directory using tar.extractall(HOME) without validating member paths or restricting extraction to an expected .openclaw subtree. A crafted tarball can overwrite arbitrary files in the home directory via unexpected paths or symlink/path traversal behaviors, which is especially dangerous because this skill is specifically designed to ingest external backup archives.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs running backup/restore scripts and setting up a cron job, which implies file-write and likely network/notification capabilities, yet it declares no tool scope or permissions. For a skill that handles configuration, memory, credentials, and scheduled execution, missing explicit scoping weakens reviewability and can enable overbroad access to sensitive data and persistence mechanisms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The backup scope explicitly includes ~/.openclaw/.env and ~/.openclaw/credentials/, which likely contain API keys and authentication material, but the skill provides no prominent warning about the sensitivity of the resulting archive. Users may store, transmit, or automate backups insecurely, leading to credential compromise and full agent or account takeover.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The restore instructions tell users to run a restore operation without warning that it may overwrite existing configuration, skills, memory, or credentials. That omission can cause accidental destruction of current state, reintroduction of stale or compromised files, or unsafe rollback of security settings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script archives highly sensitive files including .env, credentials, and identity material without any explicit warning, consent step, encryption, or permission hardening for the output archive. In the context of an agent self-backup skill, this is more dangerous because users may invoke it routinely and then store or transfer backups, unintentionally exposing secrets that enable account or agent compromise.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The backup scope is described as agent configuration, skills, memory, and workspace state, but it also includes unrelated investment documents. This broadens data collection beyond the stated purpose and can cause unintended exfiltration or retention of sensitive personal/business content during backup handling or sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script automatically deletes older backups once more than six exist, without warning or confirmation. In a recovery-oriented backup tool, silent retention pruning can cause data loss, remove needed restore points, and reduce forensic/history availability, especially if backups are created frequently or unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script performs bulk writes into HOME immediately after printing filenames, with no interactive confirmation, dry-run, or summary of affected paths. In a restore skill, this raises the chance of accidental destructive overwrite and makes exploitation of a malicious archive easier because the user gets no final checkpoint before filesystem changes occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example cron command specifies --tz "Asia/Shanghai", which imposes a specific locale setting in natural-language guidance without indicating that users should choose their own timezone. This can violate locale policy expectations unless the region-specific constraint is optional or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language strings and description are entirely in Chinese, and the file does not indicate that the locale is intentionally region-specific or optional. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description says it 'also handles restore' including restore and recovery use cases, but this script only creates archives and lists existing backups. No restore behavior is implemented here despite the manifest implying that capability is part of the skill's actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring and all user-facing console output are written in Chinese, which imposes a specific language on users without any opt-in or alternative. This matches the locale/language policy concern for natural-language content in code files.
Content: No source excerpt is available for this finding.