self-backup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 PM UTC
• Version: 1.0.0

Overview

This backup skill is mostly purpose-aligned, but it can upload sensitive OpenClaw memory, profile, scripts, and incompletely sanitized configuration data to a GitHub repository.

Install only if you are comfortable sending OpenClaw workspace files, memory logs, scripts, skill metadata, and sanitized configuration to GitHub. Use a private repository you control, review the files before the first real push, avoid --force unless you understand the history-loss risk, and do not rely on the sanitizer to remove every possible secret.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sanitize-config.sh:20

Finding

Incomplete Secret Sanitization Can Expose Credentials Through an Unverified Backup Repository

Content

View full analysis

"$OUTPUT_FILE" ``` `scripts/backup.sh:131-153`: ```bash # Backup OpenClaw system configuration log "Backing up OpenClaw system configuration..." if [ -f "$OPENCLAW_CONFIG" ]; then if [ "$DRY_RUN" = false ]; then # Sanitize the config file to remove sensitive tokens if command -v jq &> /dev/null; then log " Sanitizing openclaw.json (removing sensitive tokens)..." # Get script directory relative to this script SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &> /dev/null && pwd)" if [ -f "$SCRIPT_DIR/sanitize-config.sh" ]; then "$SCRIPT_DIR/sanitize-config.sh" "$OPENCLAW_CONFIG" "config/openclaw.json" log " ✓ Backed up: openclaw.json (sanitized)" else log " ⚠ Sanitizer script not found, skipping openc ...[truncated 4142 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The script allows a force push to the configured backup repository via the --force flag, which can overwrite remote history and destroy existing backup data. In a backup context this is risky because a user, automation, or wrapper invoking the skill with --force could unintentionally erase prior backups or clobber legitimate remote changes.

Content

Scanner excerpt · scripts/backup.sh (reported line 268)May include surrounding context.

sh

if [ "$FORCE" = true ]; then
            log "Force pushing to repository..."
            git push origin main --force
        else
            log "Pushing to repository..."
            git push origin main || {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill is designed to create a persistent remote copy of local workspace state, including files that may contain long-term memory, behavioral instructions, and personal configuration. That persistence materially increases the blast radius of accidental exposure, repository misconfiguration, account compromise, or future unauthorized access, especially because the description encourages backing up broad categories of sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: self-backup
description: Backup important OpenClaw workspace files to a GitHub repository. Use when: (1) user wants to backup workspace configuration, (2) sync OpenClaw settings to GitHub, (3) preserve automation scripts and personal configuration, (4) create remote backup of AGENTS.md, SOUL.md, MEMORY.md, and other workspace files. Configurable for any GitHub repository.
---

# Self Backup

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

1. Install GitHub CLI (if not already installed)

bash

# Ubuntu/Debian
sudo apt install gh

# macOS
brew install gh

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly backs up highly sensitive workspace artifacts such as AGENTS.md, SOUL.md, USER.md, MEMORY.md, scripts, and memory logs to a remote GitHub repository, but it does not provide a prominent warning about the privacy and security implications of exfiltrating that data off-host. Even if the repository is intended to be private, these files can contain personal data, operational secrets, credentials-adjacent context, or agent instructions that materially increase risk if exposed or mishandled.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script claims to remove sensitive tokens and keys, but the jq filter only redacts a limited set of hard-coded fields. In a backup/sanitization context, this can create a false sense of safety and lead to secrets in unhandled fields being copied into backups, shared, or stored insecurely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/backup.sh (reported line 87)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "Error: jq is required for config sanitization"
    echo "Install with: sudo apt install jq  OR  brew install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/backup.sh (reported line 164)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "Error: jq is required for config sanitization"
    echo "Install with: sudo apt install jq  OR  brew install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/sanitize-config.sh (reported line 16)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "Error: jq is required for config sanitization"
    echo "Install with: sudo apt install jq  OR  brew install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 20)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "Error: jq is required for config sanitization"
    echo "Install with: sudo apt install jq  OR  brew install jq"
    exit 1
fi

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code creates and chmods a new file at ../backup-config.sh, which is a file write operation. Although the script logs that it is configuring the backup script, it does not explicitly warn beforehand that it will create or overwrite a local configuration file or ask for confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The setup process executes $BACKUP_SCRIPT --dry-run, which is a subprocess/shell execution. While it logs that it is testing the backup script, it does not clearly disclose before execution that setup will run another script on the user's system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.