Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.1.0

Overview

This backup skill is coherent and not deceptive, but it handles credential/session backups in a way that needs review before use.

Review before installing. Only use this skill if you are comfortable creating full ~/.openclaw archives that may contain credentials, tokens, sessions, private workspace files, and scheduled tasks. Store backups in an owner-only directory, encrypt them, avoid shared or synced locations unless protected, and verify restore archives before running the destructive restore commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.sh:5

Finding

Sensitive Backup Archives Are Created Without Restrictive Permissions

Content

View full analysis

/dev/null ``` ### Technical Analysis The script creates the backup directory and archive without setting a restrictive process umask or explicitly applying secure permissions. Consequently, the effective permissions are inherited from the caller's environment. With a common umask such as `022`, the backup directory may be accessible to other local users and the generated archive may be readable beyond its owner. This is especially sensitive because the archived `.openclaw` directory is documented as containing API keys, tokens, authentication profiles, Telegram sessions, agent state, memory, scheduled tasks, and user files. The archive consolidates this sensitive information into a single predictable location, increasing the consequences of unintended local read access. ### Attack Path 1. A user or automated job invokes `scripts/backup.sh` under a permissive umask. 2. `mkdir` and `tar` create the backup directory and archive without explicit restrictive modes. 3. The resulting archive inherits permissions that may permit access by other local accounts or processes. 4. A local attacker identifies an archive under the configured backup directory. 5. The attacker reads and extracts the archive. 6. The attacker obtains any credentials, tokens, session data, configuration, or private workspace content stored in `.openclaw`. This path requires local filesystem access and depends on the effective umask and surrounding directory pe ...[truncated 597 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/backup.sh:19

Finding

Backup Rotation Uses Whitespace-Unsafe Filename Parsing

Content

View full analysis

/dev/null | tail -n +8 | xargs -r rm ``` ### Technical Analysis The rotation pipeline parses human-readable `ls` output and passes it through line- and whitespace-oriented utilities before invoking `rm`. Filesystem paths may legally contain spaces, tabs, quotes, backslashes, or newlines. The pipeline therefore does not reliably preserve each matched pathname as one argument. If the backup directory path or a matching archive filename contains such characters, `xargs` can split or reinterpret the output. As a result, `rm` may receive arguments different from the files selected by `ls`. This can cause rotation failure or deletion of unintended paths accessible to the invoking user. Exploitation generally requires an attacker to influence the backup directory argument or create crafted `openclaw-*.tar.gz` entries in the backup directory. The insecure directory permissions described separately may make such influence more plausible in some environments. ### Attack Path 1. An attacker gains the ability to influence the backup directory path or create a specially named file matching `openclaw-*.tar.gz` in that directory. 2. The directory contains more than seven matching entries, causing the crafted entry to reach the deletion portion of the rotation pipeline. 3. `ls` emits the pathname as text. 4. `tail` forwards that text without preserving pathname boundaries. 5. `xargs` splits or interprets the pathname using whitespace and quoting rules. 6. `rm` receives malformed or unintended arguments. 7. Rotation fails, or unintended files writable by the backup process are deleted. The exact deletion target depends on the crafted name, current working directory, selected backup d ...[truncated 506 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code matches part of the declared purpose: it backs up the ~/.openclaw directory, applies exclusions, and performs backup rotation. However, the description also claims restore capability and setup of automatic backup schedules, which are not implemented in this code chunk. The primary behavior is only backup creation plus simple retention cleanup, so the declared description materially overstates the implemented capabilities.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The rotation pipeline deletes files by piping ls output into xargs rm, which is unsafe when filenames contain whitespace, newlines, or leading dashes. Because BACKUP_DIR is user-controllable via the first script argument, an attacker who can place crafted matching files in that directory may cause unintended deletions during rotation.

Content

Scanner excerpt · scripts/backup.sh (reported line 21)May include surrounding context.

sh

SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
---

# OpenClaw Backup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The backup scope explicitly includes credentials, API keys, tokens, session data, agent auth profiles, and user workspace files, but the instructions do not warn users that the resulting archive is highly sensitive. This increases the chance the archive will be stored insecurely, shared, synced to third-party storage, or handled without encryption, leading to credential compromise and account/session takeover.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore sequence stops the service, moves the live ~/.openclaw directory aside, and extracts a backup in its place without an explicit warning about overwrite, version mismatch, stale state, or rollback consequences. Users may unintentionally replace newer data, restore compromised credentials/sessions, or end up with partial recovery if extraction fails, causing data loss and service integrity issues.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json

{
    "name":  "backup",
    "version":  "1.0.0",
    "description":  "Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions."
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore flow instructs users to move their live ~/.openclaw directory aside and replace it with backup contents without any explicit warning that mistakes, partial restores, or wrong archive selection can overwrite current state and lead to data loss or service disruption. Even though a safety copy is created, the document does not clearly warn users to verify paths, confirm backup integrity, or understand rollback before proceeding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The backup contents section explicitly states that backups include credentials, API keys, tokens, agent auth, workspace data, and Telegram sessions, but it provides no warning that the archive is highly sensitive. This can lead users to store, transfer, or share backups insecurely, resulting in credential compromise, account takeover, or privacy exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.