T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/restore.sh:78- Finding
Restore Safety Snapshot Copies API Secrets Without Explicit Opt-In
- Content
View full analysis
- Remediation
View remediation
Security audit
Synology Backup
Security checks for vulnerabilities and agentic risk
Overview
This backup skill mostly matches its purpose, but it can copy secrets to the NAS outside the documented opt-in boundary and can follow symlinks out of approved folders.
Review and harden this skill before installing. Remove rsync --copy-links or enforce canonical symlink containment, and change restore.sh so .env is copied only with explicit opt-in and restrictive permissions. Use a dedicated low-privilege NAS user, restrict and encrypt the backup share, run dry-run first, and review cron settings before enabling automated backups.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup.sh:101- Finding
Symlink Dereferencing Allows Backup Paths to Escape Approved Roots
- Content
View full analysis
/dev/null; then echo "✓ $name" (( backed_up++ )) || true else echo "❌ Failed to copy file: $name" >&2 (( failed++ )) || true failed_paths+=("$name") fi else if rsync -a --copy-links \ -- "$path" "${SNAP_DIR}/${name}" 2>/dev/null; then echo "✓ $name" (( backed_up++ )) || true else echo "❌ Failed to copy file: $name" >&2 (( failed++ )) || true failed_paths+=("$name") fi fi ``` The shared rsync helper repeats the same behavior: ```bash rsync_to_dest() { local src="$1" local dest_subpath="$2" local -a exclude_args mapfile -t exclude_args < <(build_exclude_args) if [[ "$TRANSPORT" == "ssh" ]]; then rsync -a --copy-links --delete -e "ssh -p ${SSH_PORT} -o BatchMode=yes -o StrictHostKeyChecking=yes" \ "${exclude_args[@]}" -- \ "$src" "$(remote_path "$dest_subpath")" else rsync - ...[truncated 2661 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (21)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **SSH transport (recommended):** Set `"transport": "ssh"` and add `"sshUser": "your-user"`. No credentials file needed — uses SSH key auth. Requires rsync + SSH access to the Synology. > ⚠️ **SSH host key warning:** Scripts use `StrictHostKeyChecking=yes`. Add your NAS host key to `~/.ssh/known_hosts` first by connecting manually once (`ssh user@nas-ip`) before automation. **Sensitive files:** The `.env` file (containing API keys) is **excluded by default**. Only add it to `backupPaths` if your NAS share is restricted to a dedicated low-privilege user and encrypted at rest. When in doubt, leave it out — you can always re-enter API keys from scratch.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **SSH transport (recommended):** Set `"transport": "ssh"` and add `"sshUser": "your-user"`. No credentials file needed — uses SSH key auth. Requires rsync + SSH access to the Synology. > ⚠️ **SSH host key warning:** Scripts use `StrictHostKeyChecking=yes`. Add your NAS host key to `~/.ssh/known_hosts` first by connecting manually once (`ssh user@nas-ip`) before automation. **Sensitive files:** The `.env` file (containing API keys) is **excluded by default**. Only add it to `backupPaths` if your NAS share is restricted to a dedicated low-privilege user and encrypted at rest. When in doubt, leave it out — you can always re-enter API keys from scratch.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/backup.sh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/backup.sh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/backup.sh
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh send_telegram "⚠️ Synology backup FAILED on $(hostname) — snapshot dir not writable: $SNAP_DIR" exit 1 fi rm -f -- "${SNAP_DIR}/.ping" fi # ---------------------------------------------------------------------------
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi # Health check: verify the NAS is actually responsive if touch "$MOUNT/.ping" 2>/dev/null && rm -f "$MOUNT/.ping" 2>/dev/null; then echo "Mount health check passed" return 0 else
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh fi # Health check: verify the NAS is actually responsive if touch "$MOUNT/.ping" 2>/dev/null && rm -f "$MOUNT/.ping" 2>/dev/null; then echo "Mount health check passed" return 0 else
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
sh exit 1 fi echo "⚠️ This will overwrite current files with snapshot from $DATE" echo " Source: $SNAP_DIR" echo "" read -r -p "Continue? [y/N] " confirm
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README promotes restore capability as 'safe' but does not prominently warn that a restore can overwrite the current workspace, configuration, and agent data. Even with pre-restore snapshots, users may trigger destructive replacement without understanding the operational risk, leading to accidental data loss or rollback to stale state.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Quick Setup 1. Install dependencies: `apt-get install -y cifs-utils rsync` 2. Create a dedicated Synology user with access to one share only 3. Create credentials file: `touch ~/.openclaw/.smb-credentials && chmod 600 ~/.openclaw/.smb-credentials` 4. Create config at `~/.openclaw/synology-backup.json` (see SKILL.md for full reference) 5. Test: `bash scripts/backup.sh --dry-run`
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - rsync - jq - cifs-utils notes: "SSH transport requires SSH key auth to Synology. SMB transport requires cifs-utils and a chmod 600 credentials file. Cron/session layer should own notifications explicitly." --- # Synology Backup
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - rsync - jq - cifs-utils notes: "SSH transport requires SSH key auth to Synology. SMB transport requires cifs-utils and a chmod 600 credentials file. Cron/session layer should own notifications explicitly." --- # Synology Backup
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - rsync - jq - cifs-utils notes: "SSH transport requires SSH key auth to Synology. SMB transport requires cifs-utils and a chmod 600 credentials file. Cron/session layer should own notifications explicitly." --- # Synology Backup
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - rsync - jq - cifs-utils notes: "SSH transport requires SSH key auth to Synology. SMB transport requires cifs-utils and a chmod 600 credentials file. Cron/session layer should own notifications explicitly." --- # Synology Backup
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - rsync - jq - cifs-utils notes: "SSH transport requires SSH key auth to Synology. SMB transport requires cifs-utils and a chmod 600 credentials file. Cron/session layer should own notifications explicitly." --- # Synology Backup
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 2. Synology Preparation 1. Create a dedicated user on the Synology (e.g., `openclaw-backup`) with minimal permissions 2. Create or choose a shared folder (e.g., `backups`) 3. Grant the user read/write access to **only** that folder — not admin access
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash touch ~/.openclaw/.smb-credentials chmod 600 ~/.openclaw/.smb-credentials # Add two lines: # username=<your-synology-user> # password=<your-synology-password>
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The cron setup example enables unattended recurring backup and verification, which results in regular automated transfer of workspace and agent data to the NAS. Without an explicit warning, users may not realize they are establishing persistent scheduled exfiltration of potentially sensitive data beyond the local host.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The security notes assert that all config values are validated before use and that restore is constrained by an explicit allowlist. In the provided file, those are intent-level guarantees rather than demonstrated behavior, so the documentation overclaims safety properties the reader cannot verify here.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The comment says the function verifies the NAS is responsive 'with a write test' after a successful mount, implying a meaningful backup-target health validation. In practice, the code only does a simple touch/remove of .ping on the mounted path, which checks basic writability but not broader backup integrity or responsiveness semantics suggested by the comment.
- Content
Static analysis
No suspicious patterns detected.