T09 · Insecure Skill Coding Practices
Error
- Location
backup-clawdbot-full.sh:22- Finding
Sensitive backup archives are created without restrictive permission safeguards
- Content
View full analysis
/dev/null || true cp ~/.clawdbot/*.json.* "$BACKUP_DIR/" 2>/dev/null || true # 2. Sessions echo "" echo -e "${YELLOW}💾 Backing up sessions...${NC}" if [ -d ~/.clawdbot/sessions ]; then tar -czf "$BACKUP_DIR/sessions.tar.gz" -C ~/.clawdbot sessions/ echo -e "${GREEN}✅ Sessions backed up${NC}" else echo -e "${BLUE}ℹ️ No sessions directory${NC}" fi # 3. Agents State echo "" echo -e "${YELLOW}🤖 Backing up agents...${NC}" if [ -d ~/.clawdbot/agents ]; then tar -czf "$BACKUP_DIR/agents.tar.gz" -C ~/.clawdbot agents/ echo -e "${GREEN}✅ Agents backed up${NC}" else echo -e "${BLUE}ℹ️ No agents directory${NC}" fi # 4. Credentials echo "" echo -e "${YELLOW}🔐 Backing up credentials...${NC}" if [ -d ~/.clawdbot/credentials ]; then tar -czf "$BACKUP_DIR/credentials.tar.gz" -C ~/.clawdbot credentials/ echo -e "${GREEN}✅ Credentials backed up${NC}" ``` ### Technical Analysis The backup operation archives configuration, session state, agent state, and authentication credentials without first setting a restrictive process umask or explicitly assigning secure permissions to the output directory and files. The resulting modes depend on the invoking user's environment. With a common `022` umask, the backup directory may be created as mode `755` and newly created archives as mode `644`. On a multi-user host, this ca ...[truncated 1853 chars]- Remediation
View remediation