ClawHub
Back to skill

Security audit

agent-backup-transfer

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is mostly purpose-aligned, but it handles sensitive OpenClaw identity data and restores archives in a way that can overwrite trusted agent files.

Review before installing. Only restore backups you created and trust, make a fresh backup before restoring, and inspect archives before extracting them. Treat generated backup files as sensitive because they may contain agent memory, identity, configuration, and credentials; store or transfer them only with strong local permissions and encryption. Use the auto-backup hook or crontab only if you are comfortable with recurring backup execution from your OpenClaw workspace.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
openclaw-backup.sh:26
Finding

Sensitive OpenClaw backups are created without enforced access restrictions or encryption

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
" echo "" echo "📂 Place your backup file anywhere, e.g.:" echo " ~/Downloads/openclaw-backup-2026-03-09.tar.gz" exit 1 fi BACKUP_FILE="$1" # Expand ~ if present BACKUP_FILE="${BACKUP_FILE/#\~/$HOME}" if [ ! -f "$BACKUP_FILE" ]; then echo "❌ Error: File not found: $BACKUP_FILE" exit 1 fi echo "⚠️ This will restore your agent from: $BACKUP_FILE" echo " Existing files may be overwritten." read -p "Cont ...[truncated 3036 chars]:52
Finding

Untrusted backup archives are extracted into the user home directory without content validation

Content
View full analysis
" echo "" echo "📂 Place your backup file anywhere, e.g.:" echo " ~/Downloads/openclaw-backup-2026-03-09.tar.gz" exit 1 fi BACKUP_FILE="$1" # Expand ~ if present BACKUP_FILE="${BACKUP_FILE/#\~/$HOME}" if [ ! -f "$BACKUP_FILE" ]; then echo "❌ Error: File not found: $BACKUP_FILE" exit 1 fi echo "⚠️ This will restore your agent from: $BACKUP_FILE" echo " Existing files may be overwritten." read -p "Continue? (y/n) " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then echo "Cancelled." exit 0 fi cd "$HOME" tar -xzf "$BACKUP_FILE" echo "" echo "✅ Restore complete!" echo "" echo "Next steps:" echo "1. Start OpenClaw: openclaw gateway start" echo "2. Open dashboard: http://127.0.0.1:18789/" } ``` ### Technical Analysis The restore operation accepts any existing file supplied by the user and extracts it directly into `$HOME`. It does not authenticate the backup or inspect archive members before extraction. No explicit allowlist ensures that entries are confined to the intended OpenClaw paths. The script also does not reject unexpected executable files, symbolic or hard links, device entries, ownership metadata, or files that replace trusted OpenClaw configuration, hooks, agents, or Skill scripts. The confirmation prompt informs the user that files may be overwritten, but it does not protect against a malicious archive or explain that restored executable content may run later. While TAR implementations may in ...[truncated 1824 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
## When to Use

- User wants to create a backup of their agent
- User wants to move to a new computer
- User asks how to preserve their agent's memory/identity
- Important memories or updates happened — time to save!

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Or add daily backups via crontab:

bash
crontab -e
# Add: 0 2 * * * ~/.openclaw/workspace/skills/openclaw-backup/openclaw-backup.sh create

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · openclaw-backup.sh (reported line 137)May include surrounding context.

sh
Or add daily backups via crontab:
```bash
crontab -e
# Add: 0 2 * * * ~/.openclaw/workspace/skills/openclaw-backup/openclaw-backup.sh create
```

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The restore instructions tell users to extract a backup tarball directly into the home directory without warning that existing ~/.openclaw data may be overwritten or merged. This can cause accidental loss or corruption of current agent state, and if the archive contents are untrusted or stale, it can replace configuration or session data unexpectedly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

The setup-auto command writes an executable hook into the agent workspace that will repeatedly invoke the backup script, creating a persistence mechanism inside the OpenClaw environment. Although the apparent goal is legitimate auto-backup, persistence features are security-sensitive because they cause future code execution and could be abused if the workspace or skill path is modified by an attacker.

Content

Scanner excerpt · openclaw-backup.sh (reported line 110)May include surrounding context.

sh
cmd_setup_auto() {
    echo "🔧 Setting up auto-backup hook..."
    
    # Create a hook script that backs up when called
    mkdir -p "$WORKSPACE_DIR/.hooks"
    
    cat > "$WORKSPACE_DIR/.hooks/post-memory-save.sh" << 'HOOK'