Openclaw Backup

• Verdict: Advisory
• Analyzed: Apr 30, 2026, 5:08 AM
• Findings: 0
• Version: 1.0.0
• Reason codes: None
• Engine: v2.4.5

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Anyone or anything with access to the created Desktop backup folder could read the copied OpenClaw API keys.

Why it was flagged

The script copies the local OpenClaw credentials directory into a Desktop backup folder. This is disclosed and aligned with the backup purpose, but it creates an additional copy of API keys.

Skill content

BACKUP_DIR="$HOME/Desktop/OpenClawBackup-$DATE"
...
cp -r ~/.openclaw/credentials "$BACKUP_DIR/"

Recommendation

Run it only when you want this backup, keep the backup folder private, consider storing it in encrypted storage, and delete old backups when they are no longer needed.