Publish

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:10 AM UTC
• Version: 1.0.12

Overview

This backup skill has a legitimate purpose, but its implementation can upload more local workspace data than promised and handles secrets and GitHub credentials unsafely in failure paths.

Review this skill carefully before installing. Use only a private, dedicated GitHub repository and a fine-grained token limited to that repository. Do not rely on its documented exclusions or secret scanner; inspect staged files yourself before any push, and avoid running it on a workspace containing secrets or private data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: sync.sh:31

Finding

Backup Exclusions Can Be Bypassed, Allowing Sensitive Files to Be Uploaded

Content

View full analysis

/dev/null || { # Fallback to cp if rsync fails rm -rf "$BACKUP_DIR/skills" cp -r "$WORKSPACE/skills" "$BACKUP_DIR/" } # === Safe Copy: Scripts using rsync with exclude patterns === if [[ -d "$WORKSPACE/scripts" ]] && [[ -n "$(ls -A "$WORKSPACE/scripts/" 2>/dev/null)" ]]; then rsync -a \ --exclude='.git' \ --exclude='AGENTS.md' \ --exclude='SOUL.md' \ --exclude='USER.md' \ --exclude='TOOLS.md' \ --exclude='IDENTITY.md' \ --exclude='HEARTBEAT.md' \ --exclude='SITES.md' \ --exclude='MEMORY.md' \ "$WORKSPACE/scripts/" "$BACKUP_DIR/scripts/" 2>/dev/null || { # Fallback to cp if rsync fails rm -rf "$BACKUP_DIR/scripts" cp -r "$WORKSPACE/scripts" "$BACKUP_DIR/" } fi ``` ### Technical Analysis The implemented exclusions do not match the documented security guarantees. Neither copy operation excludes `.env` files or `credentials` directories. The scripts copy also does not exclude `node_modules`. More critically, any nonzero `rsync` result invokes an unrestricted `cp -r` fallback. This fallback ignores every exclusion, including `.git`, personal Markdown files, dependency directories, and other sensitive content. Because stderr is discarded, users may not know that the insecure fallback was used. The subsequent secret scan is pattern-based and cannot guarantee detection of all credentials or sensit ...[truncated 1228 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: sync.sh:78

Finding

Secret Detection Prints Sensitive Values and Deletes Repository Metadata

Content

View full analysis

/dev/null || true) if [[ -n "$SECRETS_FOUND" ]]; then echo "Error: Potential secret detected in backup directory!" echo "$SECRETS_FOUND" echo "Aborting backup for safety." rm -rf "$BACKUP_DIR/.git" exit 1 fi ``` ### Technical Analysis `grep` returns the complete matching line, including the suspected secret. The script then prints the entire result through `echo "$SECRETS_FOUND"`. This can disclose credentials in terminal history, CI logs, monitoring systems, or captured process output. The error path also recursively deletes `$BACKUP_DIR/.git`. Since `BACKUP_DIR` is the directory containing `sync.sh`, this is the skill's working repository rather than a dedicated temporary repository. Detection of a secret therefore destroys Git metadata, including local history, branch state, remote configuration, index state, and repository-specific settings. ### Attack Path 1. A file copied into the backup directory contains text matching `SECRET_PATTERN`. 2. `grep` captures the filename, line number, and complete matching line. 3. The script prints that line, exposing the suspected secret to anyone able to read execution logs. 4. The script recursively deletes the installation's `.git` directory. 5. The local repository can no longer be used normally without reconstruction or recloning. An attacker with write access to a backed-up directory can intentionally insert a matching string to trigger both the log disclosure and destructive deletion behavior. ### Impact Assessment The disclosure is limited to matching data readable by the process, but may include live API tokens, private-key material, or other credentials. Anyone with access to output or CI logs may ...[truncated 211 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: sync.sh:115

Finding

GitHub Credential Can Remain Stored When Backup Push Fails

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: restore.sh:48

Finding

GitHub Credential Can Remain Stored When Restore Clone Fails

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: sync.sh:74

Finding

Secret Scanner Is Materially Weaker Than Its Documented Security Guarantees

Content

View full analysis

/dev/null || true) ``` ### Technical Analysis The documentation states that the skill detects more than 100 secret patterns, JWTs, bearer tokens, private keys, and high-entropy strings. The implementation is a single limited regular expression covering only several fixed token prefixes, one broad character-sequence pattern, and selected private-key headers. It does not perform entropy analysis and has no explicit handling for JWT structure, bearer-token syntax, many modern GitHub token formats, generic password assignments, cloud provider credentials outside the listed prefix, database URLs, or arbitrary application secrets. Pattern-based scanning also cannot identify sensitive personal data that does not resemble a credential. The scanner is the final safeguard before `git add -A` and push, making unsupported secret formats particularly consequential when the copy filters also omit sensitive paths. ### Attack Path 1. A file under a backed-up directory contains a valid secret not matched by `SECRET_PATTERN`, such as an unsupported token format, password assignment, connection string, or credential stored in structured data. 2. The copy stage transfers the file into the backup repository. 3. Both the recursive scan and stage-level scan use the same incomplete pattern and return no match. 4. The file is committed. 5. The cre ...[truncated 445 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

bash

git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

bash

git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

bash

git clone https://github.com/your-username/ClawSync.git ~/ClawSync
cp .env.example .env
# Edit .env with your values
bash sync.sh

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code clearly implements a backup-to-GitHub workflow, including copying files, secret scanning, git staging/committing, and pushing to a GitHub repo. However, it does not implement any restore path from GitHub back into the OpenClaw workspace, so the declared description overstates its capabilities. It also only backs up the skills and scripts directories rather than the entire workspace implied by 'workspace'. The local git repo initialization/use in the backup directory is consistent with backup implementation, but the main material mismatch is the missing restore functionality.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

### 🔐 Recommended: Fine-Grained PAT

For least privilege, use a GitHub Fine-Grained PAT:
1. Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens
2. Create new token with:
   - **Repository access**: Only `$BACKUP_REPO`
   - **Permissions**: Contents: Write

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

export OPENCLAW_WORKSPACE="/tmp/test-workspace"
export GITHUB_TOKEN="dummy"

cd /tmp && rm -rf test-backup-repo && mkdir test-backup-repo
cd test-backup-repo && git init
cp ~/clawsync/sync.sh .
bash sync.sh

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

export OPENCLAW_WORKSPACE="/tmp/test-workspace"
export GITHUB_TOKEN="dummy"

cd /tmp && rm -rf test-backup-repo && mkdir test-backup-repo
cd test-backup-repo && git init
cp ~/clawsync/sync.sh .
bash sync.sh

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · restore.sh (reported line 29)May include surrounding context.

sh

# === Safe Restore: Require --force or confirmation ===
if [[ "$FORCE" != "--force" ]] && [[ "$FORCE" != "-f" ]]; then
    echo "Warning: This will overwrite existing files in $WORKSPACE"
    echo "Are you sure? (y/n)"
    read -r response
    if [[ "$response" != "y" ]] && [[ "$response" != "Y" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · restore.sh (reported line 11)May include surrounding context.

sh

REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · restore.sh (reported line 59)May include surrounding context.

sh

REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · sync.sh (reported line 11)May include surrounding context.

sh

REQUIRED_VARS=("BACKUP_REPO" "OPENCLAW_WORKSPACE")
for var in "${REQUIRED_VARS[@]}"; do
    if [[ -z "${!var}" ]]; then
        echo "Error: $var is not set. Please configure in .env"
        exit 1
    fi
done

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Using rm -rf on a computed path introduces destructive behavior if the destination path is misconfigured, unexpectedly symlinked, or if BACKUP_DIR resolves to an unintended location. In a backup skill, destructive fallback logic is especially risky because users may assume the operation is non-destructive and could lose existing local backup data.

Content

Scanner excerpt · sync.sh (reported line 44)May include surrounding context.

sh

--exclude='MEMORY.md' \
        "$WORKSPACE/skills/" "$BACKUP_DIR/skills/" 2>/dev/null || {
        # Fallback to cp if rsync fails
        rm -rf "$BACKUP_DIR/skills"
        cp -r "$WORKSPACE/skills" "$BACKUP_DIR/"
    }
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This second rm -rf has the same risk profile as the skills path deletion: a path-calculation mistake, symlink issue, or unexpected script location could erase local data. Because the script runs unattended and uses forceful recursive deletion, mistakes may not be noticed until after backup contents are lost.

Content

Scanner excerpt · sync.sh (reported line 63)May include surrounding context.

sh

--exclude='MEMORY.md' \
        "$WORKSPACE/scripts/" "$BACKUP_DIR/scripts/" 2>/dev/null || {
        # Fallback to cp if rsync fails
        rm -rf "$BACKUP_DIR/scripts"
        cp -r "$WORKSPACE/scripts" "$BACKUP_DIR/"
    }
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Deleting $BACKUP_DIR/.git on secret-detection failure can destroy repository metadata and history for the local backup repo, and the safety action is still implemented as forceful recursive deletion on a computed path. While intended to prevent accidental commits, this can cause avoidable data loss if the directory layout is unexpected or if users rely on the local repository state.

Content

Scanner excerpt · sync.sh (reported line 87)May include surrounding context.

sh

echo "Error: Potential secret detected in backup directory!"
    echo "$SECRETS_FOUND"
    echo "Aborting backup for safety."
    rm -rf "$BACKUP_DIR/.git"
    exit 1
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes backing up an OpenClaw workspace to GitHub and gives a one-command path to run the backup, but it does not clearly state that workspace contents will be transmitted to a remote repository or explain the privacy implications. Although it warns against committing some sensitive files, that narrower warning can create a false sense of safety because other confidential workspace data may still be uploaded.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes the skill as able to 'Backup and restore your OpenClaw workspace to GitHub', but this script only copies workspace files, initializes a git repository, scans for secrets, commits, and pushes to GitHub. There is no code path to fetch, pull, clone, or restore workspace contents from GitHub back into the OpenClaw workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script deletes existing backup content with rm -rf before copying when rsync fails, and the same pattern appears again for the scripts directory. Although comments describe the fallback for maintainers, there is no runtime warning, prompt, or other user-facing disclosure that existing backup data will be removed and replaced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This script initializes a git repository, stages all copied files, commits them, and pushes them to a remote GitHub repository. While the script title says 'Secure Backup Script,' the runtime output does not clearly warn the user that local workspace content will be committed and sent to a remote service.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · sync.sh (reported line 80)May include surrounding context.

sh

# Scan ENTIRE backup directory (not just staged files)
SECRET_PATTERN='(ghp_[a-zA-Z0-9]{36}|sk-[a-zA-Z0-9]{20,}|AIza[a-zA-Z0-9_-]{35}|xox[pborsa]-[0-9a-zA-Z]{10,48}|AKIA[0-9A-Z]{16}|[a-zA-Z0-9/+=]{40,}|(-----BEGIN (RSA|EC|DSA|OPENSSH) PRIVATE KEY-----))'

# Recursively scan all files in backup directory
SECRETS_FOUND=$(grep -rE "$SECRET_PATTERN" "$BACKUP_DIR" --exclude-dir=.git --line-number 2>/dev/null || true)

if [[ -n "$SECRETS_FOUND" ]]; then

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:164