Clawdog Backup

• Analyzed: May 14, 2026, 4:24 AM
• Findings: 1
• Version: 1.0.1
• Hash: 0ac23800a511253895e91216337f15ad46328b56c319605f83ea7dbbe6f73dd9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill provides legitimate backup and restore functionality for core OpenClaw files and memory to OneDrive. However, the `scripts/restore.sh` script is vulnerable to a path traversal/tarbomb attack. When restoring from a user-specified local source (`--source`), the `tar -xzf` command extracts the archive to a temporary directory. A malicious archive could contain paths designed to write files outside this temporary directory during extraction, potentially leading to arbitrary file writes on the system. While the `cp -n` commands mitigate the final copy step, the initial extraction itself poses a risk.