Git-Crypt Backup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:43 AM UTC
• Version: 1.0.0

Overview

The skill is a real backup tool, but it can automatically upload broad workspace and configuration data, including secrets and sessions, with limited safeguards against plaintext exposure.

Install only if you are comfortable sending the selected Clawdbot workspace and config repositories to GitHub. Use private repos, verify git-crypt before any commit, review staged files before enabling cron, add secret scanning or an allowlist, and consider excluding live credentials, sessions, identity, and node state from automated backups.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:13

Finding

Broad Git staging can upload sensitive files without encryption

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh:13-16; related encryption configuration in SKILL.md:39-63
Vulnerability Type: Sensitive data exposure caused by incomplete path-based encryption and unrestricted staging
Risk Level: High

Vulnerable Code

scripts/backup.sh:13-16:

bash

if [[ -n $(git status --porcelain) ]]; then
    git add -A
    git commit -m "Auto backup: $TIMESTAMP"
    git push

The relevant encryption configuration documented in SKILL.md:39-63 only protects selected paths:

text

SOUL.md filter=git-crypt diff=git-crypt
USER.md filter=git-crypt diff=git-crypt
HEARTBEAT.md filter=git-crypt diff=git-crypt
MEMORY.md filter=git-crypt diff=git-crypt
memory/** filter=git-crypt diff=git-crypt

text

clawdbot.json filter=git-crypt diff=git-crypt
.env filter=git-crypt diff=git-crypt
credentials/** filter=git-crypt diff=git-crypt
telegram/** filter=git-crypt diff=git-crypt
identity/** filter=git-crypt diff=git-crypt
agents/**/sessions/** filter=git-crypt diff=git-crypt
nodes/** filter=git-crypt diff=git-crypt

Technical Analysis

The backup script uses git add -A, which stages every changed, deleted, or newly created file in each repository. Encryption is instead based on a finite list of path patterns in .gitattributes. Files that do not match those patterns are stored in Git as plaintext.

This design fails open: newly introduced credential formats, secrets placed in unexpected directories, and sensitive files omitted from the documented patterns are silently committed without encryption. The documentation explicitly identifies files such as cron/jobs.json, settings/**, AGENTS.md, IDENTITY.md, and TOOLS.md as plaintext, although such operational or identity-related files may contain sensitive information.

The script does not verify that:

• git-crypt is initialized and active;
• required .gitattributes rules e ...[truncated 1643 chars]

Remediation

View remediation

Remediation Suggestions

1. Adopt encryption by default and explicitly exempt only reviewed, non-sensitive files. For example, apply the git-crypt filter broadly and maintain a minimal plaintext allowlist.
2. Alternatively, replace git add -A with a strict allowlist of paths that are intended to be backed up.
3. Before committing, enumerate staged files and use git check-attr filter --cached -- <files> to ensure every sensitive file is covered by git-crypt. Abort the backup when validation fails.
4. Verify that git-crypt is initialized, the repository is unlocked where required, and the expected .gitattributes rules are present before staging data.
5. Add automated secret scanning to the staged diff and fail closed if credentials, tokens, private keys, or other sensitive patterns are detected.
6. Verify and document that each remote repository is private and restrict repository membership according to least privilege.
7. Review existing Git history for plaintext secrets. If exposure has already occurred, rotate affected credentials and purge sensitive objects from all branches and tags using a history-rewriting tool.
8. Add tests covering unexpected filenames and directories to ensure future configuration changes cannot silently bypass encryption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code generally matches the backup aspect of the description: it backs up the Clawdbot workspace and config by committing and pushing changes in two local git repositories. However, key declared behaviors are not present. Most importantly, there is no use of git-crypt or any encryption-related command, so the claimed encrypted backup capability is unsupported. The description also mentions manual backup/restore operations, but this code only performs backup and contains no restore logic. While pushing likely goes to a configured remote, the script does not specifically implement or validate GitHub as the destination. Therefore the description overstates the implemented functionality in material ways.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs users to place highly sensitive material such as .env files, credentials, identity, and session-related data under version control for remote backup. Although git-crypt is intended to protect file contents, any misconfiguration, pre-encryption commit, key compromise, plaintext working tree exposure, or accidental pattern omission could lead to credential disclosure and account compromise.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Config .gitattributes:

text

clawdbot.json filter=git-crypt diff=git-crypt
.env filter=git-crypt diff=git-crypt
credentials/** filter=git-crypt diff=git-crypt
telegram/** filter=git-crypt diff=git-crypt
identity/** filter=git-crypt diff=git-crypt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages backing up workspace and config data to GitHub but does not prominently warn users that automated backups will transmit potentially sensitive local data off-host. Even with private repos and git-crypt, users may unknowingly upload metadata, unencrypted files, commit history, or misclassified secrets to a third-party service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The instructions normalize persistent remote storage of workspace and config state, including agent sessions and node data, in GitHub repositories. In this context, session persistence increases the blast radius of compromise because long-lived conversation state, tokens, operational artifacts, and identity data may be retained and replicated beyond the local machine.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Setup

1. Create GitHub repos (private recommended)

bash

# Create two private repos on GitHub:

Static analysis

No suspicious patterns detected.