OpenClaw Backup (PhenixStar)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.0.0

Overview

This backup skill is purpose-aligned, but it creates and restores highly sensitive OpenClaw archives without enough safety controls or warnings.

Review before installing. Use this only if you are comfortable creating full OpenClaw backups that may contain credentials, session tokens, private workspace memory, and scheduled tasks. Store backups in an owner-only directory, encrypt them, avoid shared or synced destinations unless encrypted, and verify archive contents before restoring. Do not run the documented restore or rollback commands blindly; make a fresh safety copy first and avoid rm -rf unless you have independently verified the target path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:5

Finding

Sensitive backup archives are created without restrictive permissions

Content

View full analysis

/dev/null ``` ### Technical Analysis The backup includes the complete `.openclaw` directory, which the project documentation identifies as containing API keys, authentication profiles, Telegram sessions, scheduled tasks, configuration, memory, and user files. The script does not establish a restrictive `umask` and does not explicitly set permissions on either the backup directory or the resulting archive. Consequently, permissions depend on the invoking process's environment. Under a common `umask 022`, the directory may be created with mode `0755`, while the archive may be created with mode `0644`. Compression does not provide confidentiality. Any local account able to read the archive can extract its sensitive contents. ### Attack Path 1. A user invokes `scripts/backup.sh` with a permissive or ordinary `umask`, such as `022`. 2. `mkdir` and `tar` create the destination and archive without explicit restrictive permissions. 3. The resulting archive is readable by other local accounts if its effective mode is `0644`. 4. Another local user locates the archive under the default or supplied backup directory. 5. That user copies or extracts the archive and obtains credentials, tokens, session data, agent configuration, memory, and scheduled-task definitions. ### Impact Assessment Exploitation requires local read access resulting from the archive's effective permissions or access through another service that exposes the backup directory. A successful a ...[truncated 375 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.sh:19

Finding

Backup rotation performs unsafe filename parsing

Content

View full analysis

/dev/null | tail -n +8 | xargs -r rm ``` ### Technical Analysis The rotation logic parses the human-readable output of `ls` and sends it to `xargs`, which treats blanks, quotes, backslashes, and newlines as argument syntax. Unix filenames may legally contain spaces and newlines, so the filename boundaries emitted by `ls` are not preserved. A crafted matching filename can therefore be transformed into multiple arguments to `rm`. The command also omits the conventional `--` end-of-options marker. Although normal expanded paths are generally prefixed by the backup directory, newline-based argument injection can still create a separately parsed pathname. Exploitation requires an attacker to create files in the selected backup directory. This is plausible when a caller supplies a shared or attacker-writable custom destination, or when destination permissions are insufficiently restrictive. ### Attack Path 1. The attacker obtains write access to the configured backup directory. 2. The attacker creates enough matching `openclaw-*.tar.gz` entries to ensure a crafted entry falls beyond the seven newest files. 3. A crafted filename contains whitespace or a newline that causes `xargs` to interpret the `ls` output as multiple path arguments. 4. The legitimate user runs the backup script. 5. Rotation executes `rm` against the incorrectly reconstructed arguments. 6. Files other than the intended old backup may be deleted if the injected argument names an accessible path. ### Impact Assessment The script runs with the privileges of the invoking user. It cannot inherently exceed those privileges, but it may delete any file writable by that user if an attacker can construct a matching filename tha ...[truncated 266 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68

Finding

Restore instructions extract archives into the home directory without validating entries

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The script’s primary behavior is backup creation plus simple retention rotation, which is consistent with part of the description. However, the declared purpose claims broader functionality: restore from backup and setting up automatic backup schedules. Those capabilities are not present in the supplied code chunk. There is no evidence of undeclared harmful behavior or access to inconsistent resources; it operates on ~/.openclaw and a backup directory as expected. The mismatch is that the description materially overstates what this specific code actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The rollback instructions include an irreversible rm -rf ~/.openclaw without any warning, validation, or confirmation step. Even though this is intended to recover from a failed restore, a typo, unexpected symlink, or misunderstanding of the current state could permanently delete active user data or remove the wrong directory.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The command rm -rf ~/.openclaw is a forceful recursive deletion using a user-controlled shell expansion path, with no guardrails or validation. In a restore skill this context makes the operation plausible, but it remains risky because path mistakes, symlink abuse, or running as the wrong user can cause permanent loss of application state, credentials, and scheduled tasks.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The command rm -rf ~/.openclaw is a forceful recursive deletion using a user-controlled shell expansion path, with no guardrails or validation. In a restore skill this context makes the operation plausible, but it remains risky because path mistakes, symlink abuse, or running as the wrong user can cause permanent loss of application state, credentials, and scheduled tasks.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The pipeline ls ... | tail ... | xargs rm is unsafe because filenames are passed through whitespace-delimited text processing, so backup files with spaces, newlines, or crafted names can be split or misinterpreted and the wrong files may be deleted. In a backup utility, unintended deletion is especially dangerous because it can destroy recovery points and reduce the user's ability to restore data after an incident.

Content

Scanner excerpt · scripts/backup.sh (reported line 21)May include surrounding context.

sh

SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill’s stated purpose includes backing up credentials, auth profiles, workspace memory, and Telegram session data, which creates intentional persistence of sensitive session and authentication material. In the context of backups this can be legitimate, but it still increases risk because compromised backup archives would grant an attacker durable access to accounts and historical state.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
license: MIT
version: 1.0.0
homepage: https://github.com/PhenixStar/openclaw-skills-collection

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The backup instructions explicitly include credentials, agent auth profiles, and Telegram session data, but they do not warn that the resulting archive will contain highly sensitive secrets. Users may store or transmit backups insecurely, leading to credential theft, session hijacking, or broader compromise if the archive is accessed by others.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-restore workflow replaces the active ~/.openclaw state after renaming it aside, but it does not clearly warn that this operation is disruptive and can roll back or replace current configuration, workspace data, and sessions. In operational use, this can cause accidental data loss, restoration of stale credentials, or service interruption if performed on the wrong archive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The restore procedure tells the user to move the live ~/.openclaw directory out of the way and extract a backup over it, but it provides no warning about verifying the backup path, confirming the archive contents, or ensuring the safety copy succeeded first. In a backup/restore skill, destructive filesystem changes are expected, but omitting safety checks and confirmation guidance increases the chance of accidental data loss or restoration of unintended content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs a destructive operation by removing older backup archives via rm, but there is no confirmation prompt or advance disclosure before deletion occurs. The only user-facing messages appear after backup creation, so users are not warned that running the script will automatically prune existing backups.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.