Proton Drive Backup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:52 AM UTC
• Version: 1.0.2

Overview

The skill is a real Proton Drive backup helper, but it backs up broad sensitive OpenClaw data with limited scoping and optional Docker database volume access.

Install only if you are comfortable syncing OpenClaw configuration, memory, agent notes, drafts, media, and optionally Docker database volumes to the configured Proton Drive account. Review the hard-coded Proton path, inspect files for secrets first, avoid --docker unless needed, and prefer a version that adds dry-run output, category opt-ins, secret filtering, safer retention deletion, and a pinned container image.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/backup_to_proton.sh:82

Finding

Unpinned Docker Image Executes with Access to Sensitive Backup Volumes

Content

View full analysis

/dev/null || \ echo " ⚠️ Failed to backup $vol" ``` ### Technical Analysis The script executes the Docker image `alpine` without a version or immutable digest. The default tag is mutable, so the image retrieved and executed later may differ from the image that was reviewed. The container receives read access to the selected Docker volume through the `/data` mount and write access to the Proton Drive backup directory through `/backup`. The selected volumes can contain Langfuse, PostgreSQL, ClickHouse, Qdrant, Weaviate, or pgvector data. A malicious or compromised image could inspect that data, modify generated archives, or place arbitrary files in the synchronized backup directory. If the image is not already available locally, Docker may contact an external container registry to retrieve it. This behavior also conflicts with the `SKILL.md` metadata declaration that the skill has no outbound network behavior. ### Attack Path 1. An attacker compromises the mutable `alpine` tag, its registry distribution path, or another component in the container-image supply chain. 2. A user invokes the script with the `--docker` argument. 3. Docker retrieves or resolves the unpinned image and starts the attacker-controlled container. 4. The container reads data from the mounted application volume at `/data`. 5. The container can tamper with archives or write additional content under `/backup`, which maps to the Proton Drive synchronization directory. 6. Any maliciously generated content may subsequently be uploaded by the Proton Drive desktop client. ### Impact Assessment Successful exploitation is limi ...[truncated 582 chars]

Remediation

View remediation

other

Warning

• Location: scripts/backup_to_proton.sh:23

Finding

Broad Collection of Potentially Sensitive OpenClaw Data into Cloud-Synchronized Storage

Content

View full analysis

/dev/null || true cp ~/Library/LaunchAgents/ai.openclaw.*.plist "$PROTON/Vault/config/launchagents/" 2>/dev/null || true echo " ✅ LaunchAgent plists synced" # ── 2. OpenClaw config ──────────────────────────────────────────────────────── cp "$HOME/.openclaw/openclaw.json" "$PROTON/Vault/config/openclaw.json" echo " ✅ openclaw.json synced" # ── 3. Memory files → Vault/daily ───────────────────────────────────────────── rsync -a --update "$WORKSPACE/memory/"*.md "$PROTON/Vault/daily/" 2>/dev/null || true echo " ✅ Memory files synced to Vault/daily" # ── 4. MEMORY.md (long-term memory) ────────────────────────────────────────── cp "$WORKSPACE/MEMORY.md" "$PROTON/Vault/MEMORY.md" echo " ✅ MEMORY.md synced" ``` ```bash # ── 7. Agent OUTBOX/ROLE files ──────────────────────────────────────────────── mkdir -p "$PROTON/Vault/agents" for agent_dir in "$WORKSPACE/agents"/*/; do agent=$(basename "$agent_dir") mkdir -p "$PROTON/Vault/agents/$agent" cp "$agent_dir"*.md "$PROTON/Vault/agents/$agent/" 2>/dev/null || true done echo " ✅ Agent files synced" ``` ### Technical Analysis The script automatically copies OpenClaw configuration, long-term memory, daily memory, LaunchAgent definitions, and all Markdown files found directly under each agent directory into a hard-coded Proton Drive synchronization folder. These categories may contain API credentials, private user information, conversation-derived memory, internal role instructions, operational details, or filesystem paths. The script does not scan for secrets, apply a narro ...[truncated 1839 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The deletion pipeline ls ... | tail -n +4 | xargs rm -f is unsafe because filenames are parsed through whitespace-delimited tools and then fed to rm without null delimiting. Crafted backup filenames containing spaces, newlines, or dash-prefixed names could lead to unintended deletions, and because this operates in a cloud backup path it could destroy retained archives or other files matched by parsing mistakes.

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 90)May include surrounding context.

sh

done
    # Keep only last 3 backups per volume
    for vol in langfuse_postgres_data langfuse_clickhouse_data qdrant_data weaviate_data pgvector_data; do
        ls -t "$PROTON/Artifacts/docker-backups/${vol}_"*.tar.gz 2>/dev/null | tail -n +4 | xargs rm -f 2>/dev/null || true
    done
    echo "  ✅ Docker volumes backed up"
else

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This second retention pipeline repeats the same unsafe ls | tail | xargs rm pattern, now over broader backup filename patterns. In addition to filename parsing issues, the inconsistent patterns increase the chance of deleting the wrong files or failing open and retaining excess sensitive backups, making the backup/truncation behavior unreliable and potentially destructive.

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 120)May include surrounding context.

sh

# Docker volume backups: keep last 3 per volume type
for pattern in langfuse_postgres langfuse_clickhouse qdrant weaviate pgvector grafana; do
    ls -t "$PROTON/Artifacts/docker-backups/${pattern}"*.tar.gz 2>/dev/null | tail -n +4 | xargs rm -f 2>/dev/null || true
done

echo "  ✅ Truncation complete"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

| Content Type | Retention | Rationale |
|---|---|---|
| Configs (plists, JSON) | Forever | Small, critical |
| Memory files | 60 days | Daily notes age out |
| Content drafts | Forever | Intellectual property |
| Images | 90 days | Large, reproducible |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 22)May include surrounding context.

sh

| Content Type | Retention | Rationale |
|---|---|---|
| Configs (plists, JSON) | Forever | Small, critical |
| Memory files | 60 days | Daily notes age out |
| Content drafts | Forever | Intellectual property |
| Images | 90 days | Large, reproducible |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 23)May include surrounding context.

sh

| Content Type | Retention | Rationale |
|---|---|---|
| Configs (plists, JSON) | Forever | Small, critical |
| Memory files | 60 days | Daily notes age out |
| Content drafts | Forever | Intellectual property |
| Images | 90 days | Large, reproducible |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 24)May include surrounding context.

sh

| Content Type | Retention | Rationale |
|---|---|---|
| Configs (plists, JSON) | Forever | Small, critical |
| Memory files | 60 days | Daily notes age out |
| Content drafts | Forever | Intellectual property |
| Images | 90 days | Large, reproducible |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 25)May include surrounding context.

sh

| Content Type | Retention | Rationale |
|---|---|---|
| Configs (plists, JSON) | Forever | Small, critical |
| Memory files | 60 days | Daily notes age out |
| Content drafts | Forever | Intellectual property |
| Images | 90 days | Large, reproducible |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description says it backs up configs, memory files, content drafts, and media, but this code also archives Docker volumes for service databases such as Postgres, ClickHouse, Qdrant, and Weaviate. That materially expands the data collection scope and can exfiltrate sensitive application data, credentials, embeddings, logs, and user records into cloud storage without clear disclosure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The script runs docker run with the alpine image but does not pin a tag or digest, so the backup process depends on whatever image is current in the local cache or registry at execution time. That creates a supply-chain risk: a changed or malicious image could execute arbitrary code during backups with access to mounted Docker volume data and the Proton backup directory.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script copies per-agent markdown files from agents/*/ into Proton Drive, but that behavior is not stated in the manifest description. Even though these are markdown files, they may contain prompts, operational notes, credentials, role definitions, or sensitive workflow details, so the undisclosed collection increases privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/backup_to_proton.sh (reported line 84)May include surrounding context.

sh

full="hybrid-control-plane_${vol}"
        docker volume inspect "$full" >/dev/null 2>&1 || continue
        echo "    Backing up $vol..."
        docker run --rm -v "${full}:/data" -v "$PROTON/Artifacts/docker-backups:/backup" \
            alpine tar czf "/backup/${vol}_${TIMESTAMP}.tar.gz" -C /data . 2>/dev/null || \
            echo "    ⚠️ Failed to backup $vol"
    done

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The truncation logic claims to keep only the last 3 backups per volume, but it uses filename patterns inconsistent with the names generated earlier and includes an extra grafana pattern that is never produced. This can silently fail to delete old archives, causing uncontrolled retention of sensitive database backups in cloud storage and increasing exposure if the backup location is accessed later.

Content

No source excerpt is available for this finding.