Security audit

backup

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent backup skill, but it would persist full chat history and memory, run backup automation, and copy that data to GitHub or OneDrive with limited privacy controls.

Install only if you intentionally want full conversations, long-term memory, and OpenClaw config files archived across sessions and backed up to your own GitHub or OneDrive locations. Before enabling it, review any generated PowerShell scripts, use a private or encrypted destination, avoid putting GitHub tokens in remote URLs, keep PowerShell execution policy restrictive, and add exclusions or deletion rules for secrets, personal data, and raw transcripts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The template goes beyond passive documentation by directing execution of a local PowerShell backup script. That creates an automation pathway for code execution and external side effects from a configuration artifact, which is risky if adopted by an agent without explicit user approval and tight scope controls.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The template includes cross-system backup targets to GitHub and OneDrive, expanding the skill from session archival into external data transfer. That broader capability increases attack surface and data exposure risk, especially because archived memory and history may contain sensitive conversation content.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases and activation conditions are broad enough that the skill could be invoked in situations where the user did not clearly intend to enable a workflow that archives, resets, and backs up session data. In this context, accidental invocation is more dangerous because the skill handles persistent storage and potential cloud backup of sensitive conversation content.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The description advertises automation for session reset, archival, and dual cloud backup but does not clearly warn users that full conversation content may be stored persistently and sent to external destinations. This undermines informed consent and creates a high risk of users exposing secrets, personal data, or regulated information without realizing it.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions mandate automatic archiving, long-term memory synchronization, and session reset without any visible consent, notice, or data-handling warning. Users may not realize their content is being retained across sessions, which can lead to privacy violations and inappropriate persistence of sensitive information.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The raw-history section directs saving full message bodies, timestamps, and message IDs to persistent JSONL files but does not warn users that complete conversation content will be stored. This is especially dangerous because raw transcripts often contain secrets, personal data, and regulated information that structured summaries might have excluded.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Automatic backup to GitHub and OneDrive is an external data transfer operation, yet the template provides no explicit user warning or consent step. Sending conversation-derived memory and history to third-party or remote storage can materially increase confidentiality, compliance, and accidental sharing risks.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The troubleshooting guide instructs users to embed a GitHub token directly in the remote URL (`https://[TOKEN]@github.com/...`). Tokens placed in URLs can be exposed through shell history, process listings, logs, config files, screenshots, or copied repository configuration, increasing the chance of credential leakage. In this skill’s backup context, the risk is elevated because the instructions are operational and likely to be followed verbatim during backup setup.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide recommends changing PowerShell execution policy to `RemoteSigned` or `Unrestricted` without explaining the security tradeoffs, and even shows `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser` as a fix. Lowering execution restrictions can make it easier for untrusted or malicious scripts to run, especially in a workflow that relies on local automation scripts. In this skill context, that is more dangerous because users are being guided to enable script execution specifically to run backup/archive automation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly saves complete raw conversation history and synchronizes long-term memory across sessions, but the documentation shown provides no user-consent step, retention limit, minimization rule, or warning about sensitive data capture. This creates a real privacy and security risk because secrets, personal data, and prior session content may be retained and reused beyond the user's expectation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The design sends archived data to external cloud destinations (GitHub and OneDrive) without any visible warning, consent, classification gate, or restriction on what content may be transmitted. This is dangerous because complete conversation archives and memory stores may contain confidential or regulated data, and cloud replication increases exposure, persistence, and breach surface.

Ssd 3

High

Confidence: 98% confidence
Finding: The workflow explicitly preserves full conversation history and backs it up externally, which creates a direct data leakage path for any sensitive user-provided content contained in the session. Because the design treats this as a normal operational step, private inputs, credentials, business data, or personal information could be copied to third-party services without filtering.

Ssd 3

High

Confidence: 97% confidence
Finding: Automatically saving complete message records before reset and then restoring context from persistent memory increases the chance that sensitive user data will be retained longer than expected and surfaced again in later sessions. This expands both the exposure window and the number of places where confidential information can be disclosed or mishandled.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The multi-step archive-reset-backup process normalizes routine collection, persistence, and backup of all session content, making over-collection a default behavior rather than an exception. In a skill centered on managing conversation lifecycle data, this context increases risk because repeated automated handling can cause users to stop noticing when sensitive content is being retained or exported.

Ssd 3

High

Confidence: 99% confidence
Finding: These instructions require automatic preservation of full conversation history, including raw message content, for later reuse across sessions and backups. Persisting entire transcripts creates a high-risk concentration of sensitive data and increases the chance of unauthorized reuse, leakage, or over-collection beyond what is necessary for continuity.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The template directs extracted details from the conversation to be synced into long-term memory and reused to resume future sessions. In context, this increases persistence of user data beyond the immediate session boundary and may retain information the user did not expect to become durable profile memory.

Ssd 3

High

Confidence: 99% confidence
Finding: The backup section semantically requires exporting all memory and history records to external destinations, including GitHub and OneDrive. That combines broad data collection with off-device replication, substantially increasing exposure if repositories, cloud folders, or credentials are misconfigured or compromised.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The documentation describes persistent storage and later reuse of complete conversation history and profile/configuration data across sessions. In this skill's context, that materially increases the chance of retaining sensitive prompts, credentials, personal data, and inferred user attributes, making the issue more dangerous than a generic note about storage.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The workflow instructs backing up memory and raw conversation stores to cloud providers, which creates a real data-exfiltration path from local/session context to third-party services. Because the backed-up content includes both structured memory and raw history, compromise, misconfiguration, or oversharing at the cloud destination can expose a broad and sensitive dataset.

Ssd 3

Medium

Confidence: 92% confidence
Finding: Defining long-term memory to include user profiles and preserve core information across sessions creates durable profiling and cross-session tracking risk. In a session-archive skill, this is especially sensitive because profile data can accumulate over time and be propagated into backups, widening the impact of any leak or misuse.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The raw history layer stores complete message records including content fields for recoverability, which is effectively full transcript retention. This is dangerous because transcripts commonly contain secrets, personal information, internal context, and prior instructions, and storing them in recoverable form increases the blast radius of unauthorized access or unintended reuse.

Static analysis

No suspicious patterns detected.