Security audit

Clawdog Backup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed OneDrive backup and restore tool, but it continuously handles sensitive agent state and can restore unverified files into agent identity, instruction, tool, and memory locations.

Install only if you intentionally want OpenClaw identity, user, tool, and memory state backed up to the configured OneDrive account. Review the scripts first, use a tightly controlled OneDrive/rclone configuration, prefer client-side encryption, and restore only from backups you trust. Avoid running the background monitor until you have a clear stop procedure and understand that it can keep uploading changes after the original command returns.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: scripts/restore.sh:105
Finding: Unverified Backup Archives Can Poison Persistent Agent Instructions and Memory
Content: View full analysis
/dev/null || true ``` ```bash rclone copy "$ONEDRIVE/$file" $TEMP_DIR/ log "解压..." tar -xzf $TEMP_DIR/$file -C $TEMP_DIR/ ``` ```bash if [ "$MODE" = "core" ] || [ "$MODE" = "all" ]; then if [ -n "$SOURCE" ]; then # 从本地恢复 if [ -n "$DATE" ]; then restore_from_local "$SOURCE/goudan-core-$DATE.tar.gz" "SOUL.md" restore_from_local "$SOURCE/goudan-core-$DATE.tar.gz" "AGENTS.md" restore_from_local "$SOURCE/goudan-core-$DATE.tar.gz" "IDENTITY.md" restore_from_local "$SOURCE/goudan-core-$DATE.tar.gz" "USER.md" restore_from_local "$SOURCE/goudan-core-$DATE.tar.gz" "TOOLS.md" else CORE_FILE=$(ls -t $SOURCE/goudan-core-*.tar.gz 2>/dev/null | head -1) if [ -n "$CORE_FILE" ]; then restore_from_local "$CORE_FILE" "SOUL.md" restore_from_local "$CORE_FILE" "AGENTS.md" restore_from_local "$CORE_FILE" "IDENTITY.md" restore_from_local "$CORE_FILE" "USER.md" restore_from_local "$CORE_FILE" "TOOLS.md" fi fi ``` ```bash if [ "$MODE" = "memory" ] || [ "$MODE" = "all" ]; then if [ -n "$SOURCE" ]; then # 从本地恢复 if [ -n "$DATE" ]; then restore_from_local "$SOURCE/goudan-memory-$DATE.tar.gz" "memory/" else MEMORY_FILE=$(ls -t $SOURCE/goudan-memory-*.tar.gz 2>/dev/null | head -1) if [ -n "$MEMORY_FILE" ]; then restore_from_local "$MEMORY_FILE" "memory/" fi fi ``` ### Technical Analysis The restore process accepts archives from either an arbitrary local ` ...[truncated 2345 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backup-core.sh:19
Finding: Core Agent State Is Uploaded Without Application-Level Encryption
Content: View full analysis
/dev/null || true # 同步到 OneDrive log "同步到 OneDrive..." if rclone copy $BACKUP_DIR/temp/ $ONEDRIVE/ --progress 2>&1 | tee -a $LOG_FILE; then log "✅ 核心层备份同步完成" else log "❌ 核心层备份同步失败" fi ``` ### Technical Analysis The script uses `tar -czf`, which compresses files but does not encrypt them. The resulting archive contains core Agent state, including identity, user, instruction, and tool-related files, and is copied directly to OneDrive. Although rclone and OneDrive may protect data in transit or at rest, the Skill provides no client-side, application-level encryption. Anyone who obtains access to the remote object, rclone credentials, or the local temporary archive can decompress and read its contents without an additional secret. The temporary directory is created without setting a restrictive `umask` or explicitly assigning private permissions. Its effective accessibility therefore depends on the invoking environment and existing directory permissions. ### Attack Path 1. The backup monitor detects a change to a core Agent file. 2. The script creates an unencrypted `tar.gz` archive in `/root/.openclaw/backup/temp`. 3. The archive is uploaded to the configured OneDrive remote. 4. An attacker gains access to the OneDrive account, shared remote path, rclone configuration, or local backup directory. 5. The attacker downloads or copies the archive and decompresses it using standard archive tools. 6. The attacker reads the Agent's identity, operating instructions, user context, and tool configuration. ### Impact Assessment Exposure is limited to the files deliberately placed in the core backup, b ...[truncated 446 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backup-memory.sh:19
Finding: Persistent Agent Memory Is Uploaded Without Application-Level Encryption
Content: View full analysis
/dev/null || true # 同步到 OneDrive log "同步到 OneDrive..." if rclone copy $BACKUP_DIR/temp/ $ONEDRIVE/ --progress 2>&1 | tee -a $LOG_FILE; then log "✅ 记忆层备份同步完成" else log "❌ 记忆层备份同步失败" fi # 清理临时文件 rm -rf $BACKUP_DIR/temp/* ``` ### Technical Analysis The entire persistent `memory/` directory is compressed into a `tar.gz` archive and uploaded to OneDrive. Compression does not provide confidentiality, and the Skill does not apply authenticated client-side encryption before transfer. Persistent Agent memory may include user preferences, historical context, task details, or other sensitive retained information. Access to the cloud object, local temporary archive, or associated rclone credentials is sufficient to obtain readable memory content. The script also creates files under a shared fixed temporary path without setting a restrictive `umask` or explicit file permissions. Security therefore depends on external filesystem configuration. ### Attack Path 1. The memory backup script archives the complete workspace `memory/` directory. 2. The resulting unencrypted archive is stored temporarily under `/root/.openclaw/backup/temp`. 3. The script copies the archive to the configured OneDrive path. 4. An attacker compromises or receives access to the remote account, rclone configuration, cloud share, or local backup path. 5. The attacker retrieves and decompresses the archive without needing a separate decryption key. 6. The attacker reviews the Agent's retained memory and user-related historical context. ### Impact Assessment The primary impact is confidentiality loss across the complete persistent memory dataset included in the arc ...[truncated 380 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是一个完整的“备份恢复”技能，覆盖核心文件和 memory/ 目录，并支持实时监控、定时备份和云端恢复。但提供的代码片段只实现了核心文件的实时监控备份：使用 inotifywait 监听 5 个指定文件，打包并上传到 OneDrive。代码中没有任何对 memory/ 目录的访问，没有定时调度机制（如 cron、sleep 循环或定时器），也没有从 OneDrive 下载或恢复文件的逻辑。因此，实际行为仅覆盖声明的一部分，且缺少多个关键能力，构成描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code only covers a subset of the declared functionality: weekly/scheduled backup of the memory directory to OneDrive. The declared description claims broader backup coverage (specific core files plus memory), real-time monitoring, scheduled backup, and cloud restore. Those major capabilities are not implemented in this code chunk. While the OneDrive backup aspect is consistent, the primary described scope is materially broader than the actual behavior shown, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 描述把该技能定义为“备份恢复技能”，并具体声称能备份核心文件和记忆层到 OneDrive、支持实时监控备份和定时备份、以及从云端恢复。但提供的代码块仅是 restore.sh 恢复脚本，行为集中在从 OneDrive 或本地 tar.gz 备份中解压并复制文件到目标目录。它确实覆盖了“从云端恢复”的一部分，也恢复核心层和记忆层，和描述部分一致；但没有任何备份实现、没有实时监控、没有定时执行机制。因此代码实际能力明显小于且不同于声明的主要用途，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/backup-core.sh (reported line 32)May include surrounding context.
sh
fi # 清理临时文件 rm -rf $BACKUP_DIR/temp/* } # 创建临时目录

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/backup-memory.sh (reported line 34)May include surrounding context.
sh
fi # 清理临时文件 rm -rf $BACKUP_DIR/temp/* } # 创建临时目录

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill handles highly sensitive materials: core identity/configuration files and the memory directory, then synchronizes them to OneDrive. Without an explicit privacy warning, users may unknowingly exfiltrate secrets, personal data, prompts, credentials, or agent state to a third-party cloud service, increasing confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The use of 'nohup ... &' establishes a persistent background monitoring process, which changes system state beyond the immediate session. In a backup skill that watches sensitive files and continuously syncs them, persistence increases the blast radius of misconfiguration or abuse by enabling ongoing data collection and transfer without repeated user intent checks.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
核心层文件修改后自动备份（需要启动 inotify 监控）：

bash
# 启动核心层监控（后台运行） nohup /root/.openclaw/workspace/skills/clawdog-backup/scripts/backup-core.sh > /root/.openclaw/backup/inotify.log 2>&1 &

手动触发记忆层备份：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Restore operations write files back into the workspace and can materially alter agent state, even if some paths use non-overwriting behavior by default. Insufficient warning can lead users to restore into the wrong target, corrupt local state, reintroduce stale or malicious files, or unintentionally overwrite recovery environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest only describes the skill as a backup/restore skill in natural language without specifying concrete trigger phrases, scope constraints, or exclusion conditions. In a manifest file, this can create ambiguous activation behavior because the intended invocation context is not narrowly defined.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically uploads backups of sensitive core files to a remote OneDrive location whenever changes are detected, with no explicit user consent, access control check, or data classification guard. In this skill’s context, the monitored files likely contain agent identity, instructions, tools, and user-related state, so silent exfiltration to third-party cloud storage materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script automatically uploads an archive of the workspace memory directory to a remote OneDrive destination with no consent prompt, opt-in check, or data classification guard. Because memory/ may contain sensitive agent state, user data, credentials, or operational context, this creates a real confidentiality risk through external exfiltration, even if the stated purpose is backup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script extracts archives and copies restored content into the target directory, which can change user data on disk. Although it logs actions, there is no explicit warning or confirmation before these restore operations proceed, and the usage text does not clearly warn that existing workspace contents will be modified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The description is written only in Chinese, which may impose a language expectation without documenting user opt-in or a justified locale-specific scope. The file does not indicate that the skill is intended only for Chinese-speaking users or offer language flexibility.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments and all user-facing help/output strings are written in Chinese, which imposes a language choice on users without opt-in. The file does not indicate that the script is intentionally region-specific or provide an alternative locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The restore flow retrieves backup archives from a remote OneDrive location using rclone, which is a network operation transmitting system context and backup identifiers. The script logs the step at runtime, but the usage/help text does not disclose that a remote network transfer occurs by default when no local source is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.