agent-backup-transfer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

This backup skill is mostly purpose-aligned, but it handles sensitive OpenClaw identity data and restores archives in a way that can overwrite trusted agent files.

Review before installing. Only restore backups you created and trust, make a fresh backup before restoring, and inspect archives before extracting them. Treat generated backup files as sensitive because they may contain agent memory, identity, configuration, and credentials; store or transfer them only with strong local permissions and encryption. Use the auto-backup hook or crontab only if you are comfortable with recurring backup execution from your OpenClaw workspace.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: openclaw-backup.sh:26
• Finding: Sensitive OpenClaw backups are created without enforced access restrictions or encryption<![CDATA[ ## Vulnerability Details **File Location**: `openclaw-backup.sh`, lines 26–44 **Vulnerability Type**: Plaintext storage of sensitive information with insufficiently enforced permissions **Risk Level**: Medium ### Vulnerable Code ```bash cmd_create() { mkdir -p "$BACKUP_DIR" DATE=$(date +%Y-%m-%d_%H%M%S) BACKUP_FILE="$BACKUP_DIR/openclaw-backup-$DATE.tar.gz" cd "$HOME" # Backup workspace and config tar -czf "$BACKUP_FILE" \ --exclude='*.log' \ --exclude='*.tmp' \ --exclude='node_modules' \ --exclude='.git' \ .openclaw/workspace \ .openclaw/openclaw.json \ .openclaw/identity \ .openclaw/agents echo "✅ Backup created: $BACKUP_FILE" ls -lh "$BACKUP_FILE" ``` ### Technical Analysis The backup includes the OpenClaw workspace, configuration, identity, and agent data. These locations may contain private memories, session information, identity material, configuration values, or credentials. The script stores all of this information in an unencrypted gzip-compressed TAR archive. Compression does not provide confidentiality. It also does not establish a restrictive `umask` or explicitly set permissions on either the backup directory or the generated archive. Consequently, resulting permissions depend on the invoking process's environment. With a common `022` umask, the backup directory may be created with mode `755` and the archive with mode `644`, allowing other local users to discover and read the backup. ### Attack Path 1. A user runs `openclaw-backup.sh create`. 2. The script archives sensitive OpenClaw data into `~/openclaw-backups/openclaw-backup-*.tar.gz`. 3. The user's current `umask` permits group or world read access. 4. Another local user, compromised process, or service account reads the archive. 5. The attacker extracts the archive and obtains the contained workspace, configuration, identity, and agent information. ### Impact ...[truncated 551 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set a restrictive file-creation mask before creating backup artifacts: ```bash umask 077 ``` 2. Create and enforce restrictive directory permissions: ```bash mkdir -p "$BACKUP_DIR" chmod 700 "$BACKUP_DIR" ``` 3. Explicitly restrict the completed archive: ```bash chmod 600 "$BACKUP_FILE" ``` 4. Offer authenticated encryption for backups containing identity, memory, session, or credential data. For example, encrypt the archive using a user-supplied key through an established tool that provides authenticated encryption. 5. Avoid passing encryption secrets directly on command lines, where they can appear in process listings or shell history. Prefer protected key files, file descriptors, or interactive secret input. 6. Document that backup archives contain sensitive data and must not be transferred through untrusted channels without encryption. 7. Consider writing the archive to a securely created temporary file, validating successful completion, applying mode `600`, and then atomically moving it to the final destination. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: " echo "" echo "📂 Place your backup file anywhere, e.g.:" echo " ~/Downloads/openclaw-backup-2026-03-09.tar.gz" exit 1 fi BACKUP_FILE="$1" # Expand ~ if present BACKUP_FILE="${BACKUP_FILE/#\~/$HOME}" if [ ! -f "$BACKUP_FILE" ]; then echo "❌ Error: File not found: $BACKUP_FILE" exit 1 fi echo "⚠️ This will restore your agent from: $BACKUP_FILE" echo " Existing files may be overwritten." read -p "Cont ...[truncated 3036 chars]:52
• Finding: Untrusted backup archives are extracted into the user home directory without content validation<![CDATA[ ## Vulnerability Details **File Location**: `openclaw-backup.sh`, lines 52–90 **Vulnerability Type**: Unsafe archive extraction and unrestricted overwrite of trusted files **Risk Level**: High ### Vulnerable Code ```bash cmd_restore() { if [ -z "$1" ]; then echo "❌ Error: Please specify a backup file to restore" echo "Usage: openclaw-backup restore <file>" echo "" echo "📂 Place your backup file anywhere, e.g.:" echo " ~/Downloads/openclaw-backup-2026-03-09.tar.gz" exit 1 fi BACKUP_FILE="$1" # Expand ~ if present BACKUP_FILE="${BACKUP_FILE/#\~/$HOME}" if [ ! -f "$BACKUP_FILE" ]; then echo "❌ Error: File not found: $BACKUP_FILE" exit 1 fi echo "⚠️ This will restore your agent from: $BACKUP_FILE" echo " Existing files may be overwritten." read -p "Continue? (y/n) " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then echo "Cancelled." exit 0 fi cd "$HOME" tar -xzf "$BACKUP_FILE" echo "" echo "✅ Restore complete!" echo "" echo "Next steps:" echo "1. Start OpenClaw: openclaw gateway start" echo "2. Open dashboard: http://127.0.0.1:18789/" } ``` ### Technical Analysis The restore operation accepts any existing file supplied by the user and extracts it directly into `$HOME`. It does not authenticate the backup or inspect archive members before extraction. No explicit allowlist ensures that entries are confined to the intended OpenClaw paths. The script also does not reject unexpected executable files, symbolic or hard links, device entries, ownership metadata, or files that replace trusted OpenClaw configuration, hooks, agents, or Skill scripts. The confirmation prompt informs the user that files may be overwritten, but it does not protect against a malicious archive or explain that restored executable content may run later. While TAR implementations may in ...[truncated 1824 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. List and validate every archive member before extraction: ```bash tar -tzf "$BACKUP_FILE" ``` 2. Apply a strict allowlist permitting only the expected backup paths, such as: ```text .openclaw/workspace/ .openclaw/openclaw.json .openclaw/identity/ .openclaw/agents/ ``` 3. Reject archive members containing absolute paths, `..` path components, control characters, unexpected top-level directories, device nodes, FIFOs, symbolic links, or hard links. 4. Extract into a securely created temporary directory rather than directly into `$HOME`: ```bash RESTORE_DIR="$(mktemp -d)" chmod 700 "$RESTORE_DIR" ``` 5. Validate the extracted tree and file types before copying approved files into their destinations. 6. Do not preserve archive-supplied ownership or elevated permission bits. Use appropriate TAR safety options supported by the target platform, such as disabling ownership preservation and preventing replacement through links. 7. Require backup authenticity verification before restoring. A detached signature or authenticated encryption scheme can establish that a backup came from a trusted source and was not modified. 8. Present a summary of affected paths before confirmation, distinguish executable content from data, and require separate explicit approval before replacing hooks, scripts, or other code-bearing files. 9. Create a rollback copy of existing files before replacement and perform the final restore using controlled, atomic operations where practical. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent

Content

## When to Use

- User wants to create a backup of their agent
- User wants to move to a new computer
- User asks how to preserve their agent's memory/identity
- Important memories or updates happened — time to save!

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Or add daily backups via crontab:
```bash
crontab -e
# Add: 0 2 * * * ~/.openclaw/workspace/skills/openclaw-backup/openclaw-backup.sh create
```

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Or add daily backups via crontab:
```bash
crontab -e
# Add: 0 2 * * * ~/.openclaw/workspace/skills/openclaw-backup/openclaw-backup.sh create
```

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The restore instructions tell users to extract a backup tarball directly into the home directory without warning that existing `~/.openclaw` data may be overwritten or merged. This can cause accidental loss or corruption of current agent state, and if the archive contents are untrusted or stale, it can replace configuration or session data unexpectedly.

Session Persistence

Medium

• Category: Rogue Agent

Content

cmd_setup_auto() {
    echo "🔧 Setting up auto-backup hook..."
    
    # Create a hook script that backs up when called
    mkdir -p "$WORKSPACE_DIR/.hooks"
    
    cat > "$WORKSPACE_DIR/.hooks/post-memory-save.sh" << 'HOOK'

• Confidence: 79% confidence
• Finding: The setup-auto command writes an executable hook into the agent workspace that will repeatedly invoke the backup script, creating a persistence mechanism inside the OpenClaw environment. Although the apparent goal is legitimate auto-backup, persistence features are security-sensitive because they cause future code execution and could be abused if the workspace or skill path is modified by an attacker.

Static analysis

No suspicious patterns detected.