ClawHub
Back to skill

Security audit

Git-Crypt Backup

Security checks across malware telemetry and agentic risk

Overview

This is a transparent backup skill that pushes Clawdbot workspace and configuration repositories to GitHub, with sensitive-data risk that is expected for its purpose and should be managed carefully.

Install only if you want these Clawdbot directories backed up to GitHub. Use private repositories, verify `git-crypt` is active before the first push, test that sensitive files are encrypted from a fresh clone, inspect `git status` before enabling cron, and store exported git-crypt keys securely.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation instructs users to back up workspace and configuration data to a remote Git repository, including highly sensitive materials such as .env files, credentials, identity data, and session data, without a prominent warning about privacy, remote exfiltration risk, repository misconfiguration, or incomplete encryption coverage. This is dangerous because users may transmit secrets off-device under the assumption that 'private repo' and partial git-crypt configuration are sufficient, when mistakes in .gitattributes, remote selection, or key handling could expose confidential data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.