Security audit

GitClaw

Security checks across malware telemetry and agentic risk

Overview

GitClaw has a clear backup purpose, but it quietly sets up broad GitHub workspace syncing with system installs and persistent cron automation without enough user review controls.

Install only if you intentionally want your OpenClaw workspace repeatedly backed up to GitHub. Use a private repository, review the exact files first, exclude secrets and logs before any push, require approval for sudo installs and cron setup, and verify how to remove the crontab entry and ~/.openclaw/gitclaw script.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (59)

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill says to use itself automatically when installed or merely 'reference[d],' and the trigger phrases are broad enough to activate on loosely related requests. In context, that broad activation is dangerous because the skill performs package installation, GitHub authentication, repository creation, and recurring data exfiltration to a remote service without requiring an explicit, informed opt-in for each high-risk action.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to act 'automatically and quietly' while making system changes and configuring remote backup behavior. Silent execution reduces user awareness and consent around privileged installs, cron persistence, and uploading workspace contents, materially increasing the likelihood of unnoticed harmful actions.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill's stated purpose is to back up the OpenClaw workspace to GitHub, which semantically means copying potentially sensitive agent and user data to a third-party remote repository. Because the workspace may contain prompts, notes, credentials, tokens, or other confidential artifacts, blanket backup creates a direct exfiltration risk.

Ssd 3

High

Confidence: 99% confidence
Finding: Telling the agent to operate 'automatically and quietly' while collecting and pushing workspace contents to GitHub makes the exfiltration channel less visible to the user. The lack of transparency increases the chance that sensitive files are uploaded without meaningful consent or review.

Ssd 3

High

Confidence: 99% confidence
Finding: The backup script runs `git add -A` and pushes all changes on a schedule, which continuously exports any newly added workspace content to GitHub. In this skill's context, that creates persistent ongoing leakage of whatever sensitive material later appears in the workspace, not just the initial snapshot.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists: - `sudo zypper install -y git` - Else if `apk` exists:
Confidence: 90% confidence
Finding: Using `--noconfirm` for package installation removes an opportunity for the user to review or stop system changes. In this skill, that autonomy is riskier because it is coupled with sudo-based installation and later persistence/configuration steps.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - `sudo yum install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `pacman` exists: - `sudo pacman -S --noconfirm cronie` - `sudo systemctl enable --now cronie || true` - Else if `apk` exists: - `sudo apk add dcron`
Confidence: 90% confidence
Finding: Using `--noconfirm` to install cron-related packages enables unattended setup of scheduling infrastructure. That is dangerous here because the schedule is then used to create persistent recurring remote backups of the workspace.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - `sudo zypper install -y gh` - Else if `pacman` exists: - `sudo pacman -S --noconfirm github-cli` - Else if `apk` exists: - `sudo apk add github-cli`
Confidence: 90% confidence
Finding: Using `--noconfirm` to install GitHub CLI enables unattended addition of tooling that will authenticate to and push data to GitHub. In context, this lowers friction for remote data export without adequate user review.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Confidence: 96% confidence
Finding: The skill directs use of `sudo` to install system packages automatically. Privileged execution is dangerous because the skill is not limited to read-only actions; it modifies the system, trust configuration, and backup behavior in support of remote data transfer.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Confidence: 96% confidence
Finding: The skill directs use of `sudo` to install system packages automatically. Privileged execution is dangerous because the skill is not limited to read-only actions; it modifies the system, trust configuration, and backup behavior in support of remote data transfer.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists:
Confidence: 95% confidence
Finding: This finding is a true positive because the skill includes root-level package installation paths for git. In the broader workflow, that privilege is part of an automated chain that prepares the machine for persistent GitHub syncing, making the elevated action security-relevant.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists:
Confidence: 95% confidence
Finding: The use of `sudo` to install git through another package manager is still a privileged system modification. Because the skill auto-runs and proceeds quietly, elevated installation contributes to an unsafe level of agent autonomy.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists: - `sudo zypper install -y git` - Else if `apk` exists:
Confidence: 95% confidence
Finding: This privileged installation path combines `sudo` with non-interactive behavior. In context, the combination increases risk because it can alter the host without user review while setting up later exfiltration and persistence steps.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists: - `sudo zypper install -y git` - Else if `apk` exists: - `sudo apk add git` - Else if macOS and `xcode-select` exists:
Confidence: 95% confidence
Finding: The skill instructs privileged installation on another platform path, which is still a true vulnerability due to unnecessary automated elevation. The risk is amplified by the end goal of sending local workspace contents to a remote repo.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: If missing, attempt install: - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie`
Confidence: 96% confidence
Finding: The skill uses `sudo` to install cron and start services, which are privileged persistence-enabling operations. In this skill, those operations directly support ongoing scheduled export of workspace contents, making the risk materially higher than a generic package install.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: If missing, attempt install: - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie`
Confidence: 96% confidence
Finding: The skill uses `sudo` to install cron and start services, which are privileged persistence-enabling operations. In this skill, those operations directly support ongoing scheduled export of workspace contents, making the risk materially higher than a generic package install.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Confidence: 96% confidence
Finding: Using `sudo systemctl enable --now cron` or similar service-start commands is a privileged change that persists background execution across reboots. Here that persistence is tied to automatic backups, so the elevated action enables recurring remote data transfer.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Confidence: 96% confidence
Finding: Using `sudo systemctl enable --now cron` or similar service-start commands is a privileged change that persists background execution across reboots. Here that persistence is tied to automatic backups, so the elevated action enables recurring remote data transfer.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `yum` exists: - `sudo yum install -y cronie`
Confidence: 95% confidence
Finding: This root-level install path for cronie is a true positive because it changes the host to support scheduled execution. In context, it is part of a chain that culminates in unattended pushes of local data to GitHub.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `yum` exists: - `sudo yum install -y cronie` - `sudo systemctl enable --now crond || true`
Confidence: 95% confidence
Finding: Service enablement with `sudo` is security-relevant because it establishes persistence. Within this skill, that persistence underpins the recurring backup mechanism, so the risk is not merely administrative but directly tied to ongoing exfiltration behavior.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `yum` exists: - `sudo yum install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `pacman` exists: - `sudo pacman -S --noconfirm cronie`
Confidence: 95% confidence
Finding: This privileged install step is another true positive for unnecessary automated elevation. The danger stems from using root access to prepare a system for unattended scheduled uploads rather than a one-time user-reviewed action.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo systemctl enable --now crond || true` - Else if `yum` exists: - `sudo yum install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `pacman` exists: - `sudo pacman -S --noconfirm cronie` - `sudo systemctl enable --now cronie || true`
Confidence: 95% confidence
Finding: Enabling the cron service with sudo creates persistence and background execution. Because the skill's backup mechanism runs from cron, this system-level change materially increases the blast radius of any accidental or unsafe data inclusion.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo yum install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `pacman` exists: - `sudo pacman -S --noconfirm cronie` - `sudo systemctl enable --now cronie || true` - Else if `apk` exists: - `sudo apk add dcron`
Confidence: 95% confidence
Finding: This line combines privileged cron package installation with non-interactive behavior. That is unsafe because it silently prepares the host for recurring automated activity that will later upload workspace data.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo systemctl enable --now crond || true` - Else if `pacman` exists: - `sudo pacman -S --noconfirm cronie` - `sudo systemctl enable --now cronie || true` - Else if `apk` exists: - `sudo apk add dcron` - `sudo rc-update add dcron default || true`
Confidence: 95% confidence
Finding: Privileged service enablement on this platform path is a true security concern because it makes the scheduled backup durable. In the context of wholesale workspace syncing, that persistence increases the likelihood of prolonged unnoticed leakage.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - `sudo pacman -S --noconfirm cronie` - `sudo systemctl enable --now cronie || true` - Else if `apk` exists: - `sudo apk add dcron` - `sudo rc-update add dcron default || true` - `sudo rc-service dcron start || true` - Else:
Confidence: 95% confidence
Finding: This sudo package install for dcron is a privileged modification supporting background execution. It is dangerous here because the skill's purpose is to establish continuous automated syncing of potentially sensitive workspace data.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.