ClawHub
Back to skill

Security audit

Clawsync

Security checks for vulnerabilities and agentic risk

Overview

This backup and restore skill has a plausible purpose, but it bundles broad agent-control files and uses unsafe Git operations that could persist unwanted instructions, expose workspace content, or delete local Git metadata.

Review carefully before installing. Use only with a private, dedicated backup repository and a fine-grained token. Do not run the bundled scripts from a directory containing unrelated files, and do not restore AGENTS.md, SOUL.md, USER.md, HEARTBEAT.md, scripts, or skills unless you have reviewed each file and trust the repository contents.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
AGENTS.md:11
Finding

Bundled Workspace Files Hijack Agent Instructions and Poison Persistent Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
sync.sh:90
Finding

Unrestricted Git Staging Bypasses the Documented Backup Exclusion Policy

Content
View full analysis
/dev/null || true) if [[ -n "$SECRETS_FOUND" ]]; then echo "Error: Potential secret detected in backup directory!" echo "$SECRETS_FOUND" echo "Aborting backup for safety." rm -rf "$BACKUP_DIR/.git" exit 1 fi # === Git Operations === git add -A ``` ### Technical Analysis The exclusion list is applied only while copying selected files from `$OPENCLAW_WORKSPACE`. It does not constrain files that already exist in the directory containing `sync.sh`. Because `BACKUP_DIR` is the package directory and `git add -A` stages every unignored file in that directory, unrelated or sensitive files placed there can be committed and pushed. This contradicts the documentation claiming that files such as `SITES.md`, `.env`, credentials, and other secrets are never backed up. The secret scann ...[truncated 1343 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
sync.sh:96
Finding

Secret-Scan Failure Destructively Deletes Git Repository Metadata

Content
View full analysis
/dev/null || true) if [[ -n "$SECRETS_FOUND" ]]; then echo "Error: Potential secret detected in backup directory!" echo "$SECRETS_FOUND" echo "Aborting backup for safety." rm -rf "$BACKUP_DIR/.git" exit 1 fi ``` The distributed documentation includes a string that matches the configured GitHub-token expression: ```bash # Create a test file with a fake secret echo "My API key is ghp_test1234567890abcdefghijklmnopqrstuvwxyz" > /tmp/test-workspace/AGENTS.md # Run sync - should abort with error bash sync.sh # Expected output: "Error: Potential secret detected..." ``` ### Technical Analysis The scanner recursively examines the entire package directory rather than an isolated temporary backup tree. When it detects a match, it recursively deletes `$BACKUP_DIR/.git`. The package's own `SKILL.md` contains a fake `ghp_` token long enough to satisfy the scanner's token expression. Consequently, following the documented clone-and-run workflow causes the scanner to detect the bundled documentation and execute the destructive deletion branch. Deleting `.git` removes substantially more than a temporary staging operation. It removes repository history, the index, local configuration, remote definitions, branches, and metadata needed to recover or inspect repository state. ### Attack Path 1. The user clo ...[truncated 816 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
sync.sh:132
Finding

GitHub Credentials Can Persist When Git Operations Fail

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
restore.sh:38
Finding

Restore Operation Imports Unverified Remote Agent Instructions and Executable Content

Content
View full analysis
/dev/null; then gh auth setup-git 2>/dev/null || true gh repo clone "$BACKUP_REPO" "$TEMP_DIR" -- -b "$BRANCH" 2>/dev/null || \ git clone -b "$BRANCH" "https://github.com/${BACKUP_REPO}.git" "$TEMP_DIR" else if [[ -n "$TOKEN" ]]; then # Use credential helper instead of command-line token printf "https://%s@github.com" "$TOKEN" | git credential approve git clone -b "$BRANCH" "https://github.com/${BACKUP_REPO}.git" "$TEMP_DIR" printf "https://%s@github.com" "$TOKEN" | git credential reject ``` The cloned content is then copied into active Skill, script, and instruction locations: ```bash # Restore skills if [[ -d "$TEMP_DIR/skills" ]]; then mkdir -p "$WORKSPACE/skills" for item in "$TEMP_DIR/skills"/*; do if [[ -d "$item" ]] && should_restore "$(basename "$item")"; then cp -rn "$item" "$WORKSPACE/skills/" 2>/dev/null || true fi done fi # Restore scripts if [[ -d "$TEMP_DIR/scripts" ]]; then mkdir -p "$WORKSPACE/scripts" for item in "$TEMP_DIR/scripts"/*; do if [[ -f "$item" ]] && should_restore "$(basename "$item")"; then cp -rn "$item" "$WORKSPACE/scripts/" 2>/dev/null || true fi done fi # Restore identity files (exclude sensitive ones) for file in AGENTS.md SOUL.md USER.md TOOLS.md IDENTITY.md HEARTBEAT.md; do if [[ -f "$TEMP_DIR/$file" ]]; then cp -n "$TEMP_DIR/$file" "$WORKSPACE/" 2>/dev/null || true fi done ``` ### Technical Analysis The restore process trusts the current head of a configurable remote branch. It does not pin an expected commit, verify a signed commit or tag, validate a conte ...[truncated 1821 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (36)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file grants broad authority for external actions like web access, calendars, and communications workflows that are unrelated to a GitHub backup/restore skill. This scope expansion increases the chance the agent will access, process, or disclose data outside the user’s expected intent, especially when combined with 'ask first' rules that still normalize outbound-capable behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The heartbeat section authorizes ongoing monitoring, proactive checks, memory maintenance, and autonomous project work far beyond backup/restore. This creates a standing mechanism for surveillance-like behavior and unprompted actions, which can lead to unauthorized data access, privacy violations, or unintended external interactions.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

bash
git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

bash
git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash
git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

bash
git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash
git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code chunk is specifically a restore script, not a backup-and-restore implementation. It reads configuration, authenticates to GitHub, clones a backup repository, and restores selected directories/files into the local OpenClaw workspace while excluding certain sensitive items and avoiding overwrites by default. This behavior is consistent with the 'restore' half of the description, but the declared purpose overstates functionality by claiming backup capability that is absent from this code chunk. No clearly unrelated or malicious capabilities are present.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

There is a clear mismatch between the declared description and the actual code. The description claims backup and restore capabilities for an OpenClaw workspace using GitHub, but the code chunk is only a trivial shell script that prints "test". It does not access files, repositories, network resources, or any workspace state, so it does not substantively perform the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
### 🔐 Recommended: Fine-Grained PAT

For least privilege, use a GitHub Fine-Grained PAT:
1. Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens
2. Create new token with:
   - **Repository access**: Only `$BACKUP_REPO`
   - **Permissions**: Contents: Write

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
export OPENCLAW_WORKSPACE="/tmp/test-workspace"
export GITHUB_TOKEN="dummy"

cd /tmp && rm -rf test-backup-repo && mkdir test-backup-repo
cd test-backup-repo && git init
cp ~/clawsync/sync.sh .
bash sync.sh

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
export OPENCLAW_WORKSPACE="/tmp/test-workspace"
export GITHUB_TOKEN="dummy"

cd /tmp && rm -rf test-backup-repo && mkdir test-backup-repo
cd test-backup-repo && git init
cp ~/clawsync/sync.sh .
bash sync.sh

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · TOOLS.md (reported line 36)May include surrounding context.

md
## Why Separate?

Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.

---

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · restore.sh (reported line 29)May include surrounding context.

sh
# === Safe Restore: Require --force or confirmation ===
if [[ "$FORCE" != "--force" ]] && [[ "$FORCE" != "-f" ]]; then
    echo "Warning: This will overwrite existing files in $WORKSPACE"
    echo "Are you sure? (y/n)"
    read -r response
    if [[ "$response" != "y" ]] && [[ "$response" != "Y" ]]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · restore.sh (reported line 11)May include surrounding context.

sh
REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · restore.sh (reported line 59)May include surrounding context.

sh
REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · sync.sh (reported line 11)May include surrounding context.

sh
REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · sync.sh (reported line 28)May include surrounding context.

sh
REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · sync.sh (reported line 52)May include surrounding context.

sh
# === Safe Copy: Skills (with explicit exclusion) ===
if [[ -d "$WORKSPACE/skills" ]]; then
    rm -rf "$BACKUP_DIR/skills"
    mkdir -p "$BACKUP_DIR/skills"
    
    for skill in "$WORKSPACE/skills"/*; do

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · sync.sh (reported line 72)May include surrounding context.

sh
# === Safe Copy: Scripts (with explicit exclusion) ===
if [[ -d "$WORKSPACE/scripts" ]]; then
    rm -rf "$BACKUP_DIR/scripts"
    mkdir -p "$BACKUP_DIR/scripts"
    
    for script in "$WORKSPACE/scripts"/*; do

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · sync.sh (reported line 107)May include surrounding context.

sh
echo "Error: Potential secret detected in backup directory!"
    echo "$SECRETS_FOUND"
    echo "Aborting backup for safety."
    rm -rf "$BACKUP_DIR/.git"
    exit 1
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to delete BOOTSTRAP.md after reading authorizes irreversible file removal without confirmation or safety checks. In practice, this can destroy setup context, erase auditability, or delete a file the user expected to keep, especially if the agent follows instructions automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs the agent to create and update memory files containing user context and long-term notes, but the skill description does not clearly warn that personal data may be persistently stored. This can cause silent retention of sensitive information and increase the risk of later leakage across sessions or contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Incident response and retrospective instructions are unrelated to backing up or restoring a workspace and expand the operational authority of the agent. Even if well-intentioned, they encourage the agent to inspect credentials, modify memory files, and alter other skills without a clear user request tied to this skill’s purpose.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENTS.md (reported line 53)May include surrounding context.

When things go wrong (security breach, site outage, bug), run the retro skill to document and prevent recurrence:

bash
# Use the retro skill from skills/retro/SKILL.md
# It will:
# 1. Create incident report in memory/
# 2. Check for credential exposure

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:163