ClawHub
Back to skill

Security audit

Openclaw Backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is straightforward and disclosed, but it copies API-key credentials to the Desktop in plaintext without safeguards.

Review before installing. Use this only if you are comfortable with API keys and OpenClaw configuration being copied to your Desktop in plaintext. Prefer changing the backup destination to a private restricted directory, excluding credentials by default, or encrypting backups that contain secrets.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/backup.sh:3
Finding

Plaintext Backup of API Credentials to an Insufficiently Protected Desktop Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/backup.sh:3-9
Related Documentation: SKILL.md:20-29
Vulnerability Type: Plaintext storage of sensitive credentials and unsafe backup destination handling
Risk Level: High

Vulnerable code in scripts/backup.sh:

bash
BACKUP_DIR="$HOME/Desktop/OpenClawBackup-$DATE"

mkdir -p "$BACKUP_DIR"
cp ~/.openclaw/openclaw.json "$BACKUP_DIR/"
cp -r ~/.openclaw/agents "$BACKUP_DIR/"
cp -r ~/.openclaw/credentials "$BACKUP_DIR/"
cp -r ~/.openclaw/cron "$BACKUP_DIR/"

Equivalent documented procedure in SKILL.md:

bash
DATE=$(date +%Y%m%d-%H%M%S)
BACKUP_DIR="$HOME/Desktop/OpenClawBackup-$DATE"
mkdir -p "$BACKUP_DIR"
cp ~/.openclaw/openclaw.json "$BACKUP_DIR/"
cp -r ~/.openclaw/agents "$BACKUP_DIR/"
cp -r ~/.openclaw/credentials "$BACKUP_DIR/"
cp -r ~/.openclaw/cron "$BACKUP_DIR/"
echo "Backup created: $BACKUP_DIR"

Technical Analysis

The script recursively copies the complete ~/.openclaw/credentials directory, which the documentation identifies as containing API keys, into an unencrypted directory on the user's Desktop. It also copies configuration, agent definitions, and scheduled-task data that may disclose operational details.

The destination is created with mkdir -p without explicitly enforcing restrictive permissions such as mode 0700. Consequently, effective access depends on the user's current umask, existing directory permissions, and destination state. The script does not encrypt the credentials, verify that the destination is newly created and not a symbolic link, or warn about Desktop synchronization and indexing services.

Credential access is related to a comprehensive backup and is openly documented; therefore, it is not hidden malicious behavior. However, recursively copying every credential is not the minimum privilege or data scope necessary for backing up ordinary OpenClaw configuration. Secret back ...[truncated 1606 chars]

Remediation
View remediation

Remediation Suggestions

  1. Exclude ~/.openclaw/credentials from backups by default and require an explicit option, such as --include-credentials, before copying secrets.
  2. Display a clear warning and request confirmation before creating any backup containing API keys.
  3. Create the destination atomically with restrictive permissions and fail if it already exists:
    bash
    umask 077
if ! mkdir -m 700 -- "$BACKUP_DIR"; then
  echo "Refusing to use an existing or unavailable backup path" >&2
  exit 1
fi
  4. Validate that the destination and its parent are trusted directories and reject symbolic links or unexpected existing filesystem objects.
  5. Encrypt secret-containing backups with a well-maintained encryption tool and a user-supplied key or recipient identity. Do not retain an unencrypted intermediate archive.
  6. Prefer a user-selected, non-synchronized backup destination rather than the Desktop. Warn that Desktop directories may be indexed or uploaded by cloud synchronization software.
  7. Preserve or tighten source permissions when copying sensitive files, and verify after creation that no backup file is accessible to group or other users.
  8. Separate non-secret configuration backups from credential backups so users can apply different retention, encryption, and access-control policies.
  9. Document secure deletion, retention, restoration, and credential-rotation procedures for secret-containing backups.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The backup workflow creates a persistent copy of OpenClaw configuration and credential material outside the original protected location, increasing the lifetime and exposure surface of sensitive data. Even though persistence is the stated purpose of a backup skill, persisting agent configs, cron data, and especially credentials onto the Desktop materially increases the chance of compromise if the host is shared, synced, or later accessed by malware.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash
DATE=$(date +%Y%m%d-%H%M%S)
BACKUP_DIR="$HOME/Desktop/OpenClawBackup-$DATE"
mkdir -p "$BACKUP_DIR"
cp ~/.openclaw/openclaw.json "$BACKUP_DIR/"
cp -r ~/.openclaw/agents "$BACKUP_DIR/"
cp -r ~/.openclaw/credentials "$BACKUP_DIR/"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs users to copy the credentials directory, which likely contains API keys or other secrets, into a timestamped folder on the Desktop. Desktop locations are typically less protected, more visible, and more likely to be synced, shared, or accidentally exposed, and the skill provides no warning or safeguards about handling sensitive data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The script intentionally persists OpenClaw configuration, agent data, cron data, and credentials into a reusable backup copy. While persistence is the script's stated purpose, it still creates an additional copy of sensitive operational state that can be accessed later if the Desktop folder is exposed, making the persistence security-relevant rather than a false positive.

Content

Scanner excerpt · scripts/backup.sh (reported line 5)May include surrounding context.

sh
DATE=$(date +%Y%m%d-%H%M%S)
BACKUP_DIR="$HOME/Desktop/OpenClawBackup-$DATE"

mkdir -p "$BACKUP_DIR"
cp ~/.openclaw/openclaw.json "$BACKUP_DIR/"
cp -r ~/.openclaw/agents "$BACKUP_DIR/"
cp -r ~/.openclaw/credentials "$BACKUP_DIR/"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script copies the ~/.openclaw/credentials directory into a timestamped folder on the user's Desktop, which is a less protected and more easily exposed location than the original configuration directory. This increases the chance of accidental disclosure through local access, desktop sync services, screenshots, or routine file sharing, and the script provides no warning, permission hardening, or secure destination selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.