Security audit

Git Backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is openly for GitHub backups, but it uses broad credentials and can silently upload large parts of the workspace on an ongoing schedule.

Review before installing. Only use this with a repository you control, avoid giving the agent a full GitHub PAT in chat, remove token-in-URL storage, disable silent scheduled pushes, and replace whole-workspace uploads with an explicit reviewed allowlist and secret scan.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:230
Finding: Broad Upload of Sensitive Workspace Data to a Hard-Coded Repository
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:25
Finding: Excessive Credential Discovery and Insecure Token Persistence
Content: View full analysis
/dev/null \ | grep -oP 'ghp_[A-Za-z0-9]+' | head -1) [ -n "$TOKEN" ] && echo "$TOKEN" && return # 2. Check standard environment variables [ -n "${GITHUB_TOKEN:-}" ] && echo "$GITHUB_TOKEN" && return [ -n "${GH_TOKEN:-}" ] && echo "$GH_TOKEN" && return # 3. Check credential files for f in ~/.credentials/github*.txt ~/.credentials/gh*.txt; do [ -f "$f" ] && cat "$f" | head -1 | tr -d '[:space:]' && return done # 4. Check ~/.bashrc for embedded token TOKEN=$(grep -oP 'ghp_[A-Za-z0-9]+' ~/.bashrc 2>/dev/null | head -1) [ -n "$TOKEN" ] && echo "$TOKEN" && return # Not found — return empty echo "" } TOKEN=$(find_github_token) ``` ```text I need a GitHub Personal Access Token to back up your workspace. Go to: github.com → Settings → Developer Settings → Personal access tokens → Generate new token Required permission: repo (full) Send me the token (starts with ghp_) ``` ```bash # Save token to credentials file echo "$TOKEN" > ~/.credentials/github-token.txt chmod 600 ~/.credentials/github-token.txt # Update the git remote URL to include the token git -C "$HOME/.openclaw/workspace" remote set-url origin \ "https://${TOKEN}@github.com/GITHUB_USERNAME/REPO_NAME.git" ``` ### Technical Analysis The Skill systematically searches Git remotes, process environment variables, wildcard credential files, and `.bashrc` for GitHub tokens. Reading arbitrary credential files and shell initialization files is not necessary when standard credential helpers or GitHub CLI authentication can provide repository access. The token is subsequently stored in a plaintext file and embedded in a Git remote URL. Althoug ...[truncated 1780 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:206
Finding: Silent Scheduled Workspace Synchronization Establishes Persistence
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:8
Finding: Arbitrary Shell Execution Through Sourced Mutable Context File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions ask the owner to send a PAT directly in chat and then save it for later use. Collecting high-value credentials through chat and persisting them creates a strong chance of credential disclosure, replay, and misuse beyond the immediate backup operation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The skill explicitly asks the owner to generate and send a full repo-scoped personal access token. Soliciting a powerful credential in-band is dangerous because it exposes the secret to chat logs and to any component that can read the transcript.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
If TOKEN is empty → stop and ask the owner:

text
I need a GitHub Personal Access Token to back up your workspace. Go to: github.com → Settings → Developer Settings → Personal access tokens → Generate new token Required permission: repo (full) Send me the token (starts with ghp_)

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The access-token instruction continues the unsafe credential collection flow by directing the user to provide the token directly to the agent. In this context, the token grants repository access and can be reused to read or write backups containing additional sensitive data.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
If TOKEN is empty → stop and ask the owner:

text
I need a GitHub Personal Access Token to back up your workspace. Go to: github.com → Settings → Developer Settings → Personal access tokens → Generate new token Required permission: repo (full) Send me the token (starts with ghp_)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill tells the agent to persist a GitHub PAT to disk and embed it in the remote URL, which can expose the token via config files, process output, logs, shell history, or accidental repo leakage. There is no meaningful warning or safer handling guidance despite the sensitivity of a full-repo token.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
# Create .gitignore to exclude secrets and temp files cat > .gitignore << 'EOF' *.log .env credentials/ *.key *.pem

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill stages and pushes the workspace with git add -A while only offering a minimal .gitignore, so secret-bearing files, config, memory, and previously committed credentials can be exfiltrated to GitHub. In this context, the stated purpose is external backup, which makes over-collection especially dangerous because the transmission is intentional and routine.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims it will ask the owner for a PAT if none is available, but first instructs the agent to scrape tokens from remotes, environment variables, shell startup files, and credential files. That broad credential discovery behavior expands access beyond least privilege and can harvest secrets not intended for this task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation guidance is overly broad, allowing the skill to trigger on vague phrases like saving or remembering something important. In a backup skill that performs external pushes, ambiguous activation increases the chance of unintended publication of sensitive workspace contents.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
bash
# Save token to credentials file echo "$TOKEN" > ~/.credentials/github-token.txt chmod 600 ~/.credentials/github-token.txt # Update the git remote URL to include the token git -C "$HOME/.openclaw/workspace" remote set-url origin \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This performs an authenticated outbound request to GitHub using the discovered token. While network access to GitHub is expected for backups, it still constitutes external transmission and increases risk because the same skill also gathers credentials and broad workspace content.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
GITHUB_USER="github-username" # change to your GitHub username # HTTP 200 = repo exists, 404 = need to create it STATUS=$(curl -s -o /dev/null -w "%{http_code}" \ -H "Authorization: token $TOKEN" \ "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
HTTP 200 = repo exists, 404 = need to create it

STATUS=$(curl -s -o /dev/null -w "%{http_code}"
-H "Authorization: token $TOKEN"
"https://api.github.com/repos/$GITHUB_USER/$REPO_NAME")

echo "Repo check: HTTP $STATUS"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This creates a GitHub repository via an authenticated API call, which is an external action that can establish a new destination for workspace data. In context, the concern is not the API use itself but that it supports routine exfiltration of broadly scoped local content.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
Create the repo (if HTTP 404)

bash
curl -s -X POST "https://api.github.com/user/repos" \ -H "Authorization: token $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"name\": \"$REPO_NAME\", \"private\": true, \"description\": \"PA workspace backup\"}" \

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'When to Back Up' section uses imprecise triggers like 'remember this' and 'after completing a significant task', which can cause accidental execution without informed consent. Because the resulting action commits and pushes data externally, unclear triggering materially raises the risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The backup scope explicitly includes broad categories such as memory, notes, skills, data, and config, which commonly contain sensitive operational and personal information. Routine transmission of these directories to GitHub increases the likelihood of privacy and secret leakage, even if the repo is intended to be private.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
GITHUB_USER="github-username" # change to your GitHub username # HTTP 200 = repo exists, 404 = need to create it STATUS=$(curl -s -o /dev/null -w "%{http_code}" \ -H "Authorization: token $TOKEN" \ "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME")

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T06 · System Persistence

T09 · Insecure Skill Coding Practices

SkillSpector

Ssd 3

Credential Access

Credential Access

Missing User Warnings

Credential Access

Description-Behavior Mismatch

Intent-Code Divergence

Vague Triggers

Sudo/Root Execution

External Transmission

External Transmission

HTTP 200 = repo exists, 404 = need to create it

External Transmission

Create the repo (if HTTP 404)

Vague Triggers

Ssd 3

External Script Fetching

Static analysis