Security audit

Backup Manager Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a local backup skill, but it can persistently schedule jobs, collect sensitive OpenClaw data, delete backups, and restore archives in ways that need careful review.

Install only if you want this skill to manage local OpenClaw backups and cron jobs. Review the cron setup scripts before running them, avoid setup-cron-auto.sh unless you accept unattended recurring backups and cleanup, and restore only from trusted archives because restore.sh can overwrite live OpenClaw files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: restore.sh:43
Finding: Unsafe Extraction of User-Supplied Backup Archives
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: setup-cron.sh:13
Finding: Predictable Temporary Cron Files Permit Symlink-Based File Overwrite
Content: View full analysis
"$CRON_FILE" << EOF ``` The automatic variant uses the same pattern: ```bash CRON_FILE="/tmp/openclaw-backup-cron-auto" ``` ```bash cat > "$CRON_FILE" << EOF ``` ### Technical Analysis Both cron setup scripts use fixed, globally predictable paths in `/tmp`. Shell output redirection opens the selected path and follows an existing symbolic link. The scripts do not atomically create the file, verify its owner or type, or set restrictive permissions before writing. On a multi-user system, another local account can create the predictable path as a symbolic link to a file writable by the victim. When the victim runs the setup script, the target is opened with truncation and replaced with cron configuration data. ### Attack Path 1. A local attacker predicts `/tmp/openclaw-backup-cron` or `/tmp/openclaw-backup-cron-auto`. 2. The attacker creates that path as a symbolic link to a victim-owned file that the victim can overwrite. 3. The victim runs the corresponding cron setup script. 4. `cat > "$CRON_FILE"` follows the symbolic link and truncates the linked target. 5. Cron configuration text is written into the unintended file, corrupting its prior contents. ### Impact Assessment The vulnerability permits corruption or replacement of files writable by the user running the script. It does not directly provide root privileges unless the script is improperly run as root, but it can destroy user configuration, shell files, or application state and may enable code execution if the overwritten file is later interpreted in a useful context. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: backup-full.sh:24
Finding: Sensitive Backup Archives Are Not Consistently Created with Restrictive Permissions
Content: View full analysis
/dev/null || true echo " 2. 复制配置文件..." cp "$HOME/.openclaw/openclaw.json" "$TEMP_DIR/" 2>/dev/null || true cp -r "$HOME/.openclaw/agents" "$TEMP_DIR/" 2>/dev/null || true ``` ```bash echo "🗜️ 创建完整压缩备份..." cd "$(dirname "$TEMP_DIR")" tar -czf "$BACKUP_FILE" -C "$(basename "$TEMP_DIR")" . ``` From `backup-monthly.sh`: ```bash cp -r "$HOME/.openclaw/workspace" "$TEMP_DIR/" 2>/dev/null || true cp "$HOME/.openclaw/openclaw.json" "$TEMP_DIR/" 2>/dev/null || true cp -r "$HOME/.openclaw/agents" "$TEMP_DIR/" 2>/dev/null || true cp -r "$HOME/.openclaw/extensions" "$TEMP_DIR/" 2>/dev/null || true cp -r "$HOME/.openclaw/workspace/skills" "$TEMP_DIR/" 2>/dev/null || true ``` ```bash tar -czf "$BACKUP_FILE" -C "$(basename "$TEMP_DIR")" . ``` From `restore.sh`: ```bash CURRENT_BACKUP="$HOME/.openclaw/backups/critical/pre-restore-${TIMESTAMP}.tar.gz" print_info "Creating backup of current state: $CURRENT_BACKUP" mkdir -p "$HOME/.openclaw/backups/critical" tar -czf "$CURRENT_BACKUP" \ ~/.openclaw/openclaw.json \ ~/.openclaw/agents \ ~/.openclaw/memory \ ~/.openclaw/workspace 2>/dev/null || true ``` ### Technical Analysis These archives may contain authentication profiles, configuration secrets, Agent memory, identity documents, extensions, Skills, and private workspace content. The affected scripts neither establish `umask 077` nor explicitly apply `chmod 600` to the resulting archives. `setup-backup-manager.sh` applies mode `700` to backup directories, which reduces exposure when initialization has been run successfully. However, each backup script can be invoked indepen ...[truncated 1071 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: setup-cron-auto.sh:45
Finding: Non-Interactive Installer Establishes Scheduled Persistence Without Explicit Confirmation
Content: View full analysis
> "$HOME/.openclaw/workspace/memory/backup-cron.log" 2>&1 0 3 * * 1 "$BACKUP_MANAGER_DIR/backup-full.sh" >> "$HOME/.openclaw/workspace/memory/backup-cron.log" 2>&1 0 4 1 * * "$BACKUP_MANAGER_DIR/backup-monthly.sh" >> "$HOME/.openclaw/workspace/memory/backup-cron.log" 2>&1 0 5 * * 1 "$BACKUP_MANAGER_DIR/cleanup-expired.sh" >> "$HOME/.openclaw/workspace/memory/backup-cron.log" 2>&1 ``` ```bash EXISTING_CRON=$(crontab -l 2>/dev/null || true) if [[ -n "$EXISTING_CRON" ]]; then BACKUP_FILE="$HOME/.openclaw/workspace/memory/crontab-backup-$(date +%Y%m%d_%H%M%S).txt" echo "$EXISTING_CRON" > "$BACKUP_FILE" fi { if [[ -n "$EXISTING_CRON" ]]; then echo "$EXISTING_CRON" | grep -v "OpenClaw 备份系统" | grep -v "backup-now.sh" | grep -v "backup-full.sh" | grep -v "backup-monthly.sh" | grep -v "cleanup-expired.sh" fi cat "$CRON_FILE" } | crontab - ``` ```bash "$BACKUP_MANAGER_DIR/backup-now.sh" ``` ### Technical Analysis Automated backup scheduling is part of the declared functionality, and the jobs execute as the current user rather than requesting elevated privileges. Therefore, cron itself is functionally justified. However, `setup-cron-auto.sh` installs recurring jobs, rewrites the user's crontab, schedules automatic deletion through `cleanup-expired.sh`, and immediately performs a backup without an interactive confirmation step. This conflicts with the rule in `SKILL.md:30-36` that backups must not be created automatically without user confirmation. The installer also filters the entire existing crontab using broad text matches. Existing unrelated jobs containing one of the selected script names could be removed. No dedicated uninstall operation or robust managed-block replacement is pro ...[truncated 970 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: backup-before-change.sh:50
Finding: Backup Scope Collects Credentials and Agent Identity Data Beyond Configuration-Only Needs
Content: View full analysis
/dev/null || true cp "$HOME/.openclaw/openclaw.json" "$TEMP_DIR/" 2>/dev/null || true cp -r "$HOME/.openclaw/agents" "$TEMP_DIR/" 2>/dev/null || true ``` ### Technical Analysis The Skill intentionally copies API authentication profiles, complete Agent directories, long-term memory, identity files, user data, and task lists into consolidated archives. This behavior is relevant to complete disaster recovery, and no network transfer or exfiltration code was found. Nevertheless, credentials and private Agent state are materially more sensitive than ordinary configuration. Including them by default increases the Skill's read scope and creates a single high-value archive. Configuration-only backup operations do not require every sensitive class, and the scripts provide no granular opt-in or exclusion mechanism. ### Attack Path 1. A user requests or schedules a backup while expecting ordinary configuration protection. 2 ...[truncated 842 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (82)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description emphasizes backup management, but the document also includes emergency restoration commands that can overwrite current state. Restore capability is materially more dangerous than backup-only behavior because it can replace active configuration/workspace contents and trigger integrity or availability loss if invoked on the wrong archive.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The surrounding comments and echo statements indicate the code is creating a backup from the collected temporary directory contents. However, tar -czf "$BACKUP_FILE" -C "$(basename "$TEMP_DIR")" . is inconsistent with tar's expected -C <dir> usage and does not match the stated intent to archive the temp directory contents, suggesting the implementation contradicts the documented behavior.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · backup-full.sh (reported line 60)May include surrounding context.
sh
# 创建软链接到最新完整备份 echo "🔗 更新最新完整备份链接..." rm -f "$BACKUP_ROOT/weekly/latest" ln -sf "$BACKUP_PATH" "$BACKUP_ROOT/weekly/latest" echo " ✅ 最新完整备份链接: $BACKUP_ROOT/weekly/latest -> $BACKUP_PATH"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · backup-monthly.sh (reported line 71)May include surrounding context.
sh
# 创建软链接到最新月度备份 echo "🔗 更新最新月度备份链接..." rm -f "$BACKUP_ROOT/monthly/latest" ln -sf "$BACKUP_PATH" "$BACKUP_ROOT/monthly/latest" echo " ✅ 最新月度备份链接: $BACKUP_ROOT/monthly/latest -> $BACKUP_PATH"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · backup-now.sh (reported line 116)May include surrounding context.
sh
echo -e "${BLUE}🔗 更新最新备份链接...${NC}" # 删除旧的daily/latest软链接 rm -f "$BACKUP_ROOT/daily/latest" # 创建新的软链接 ln -sf "$BACKUP_PATH" "$BACKUP_ROOT/daily/latest"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · backup-scripts.md (reported line 83)May include surrounding context.
md
echo -e "${BLUE}🔗 更新最新备份链接...${NC}" # 删除旧的daily/latest软链接 rm -f "$BACKUP_ROOT/daily/latest" # 创建新的软链接 ln -sf "$BACKUP_PATH" "$BACKUP_ROOT/daily/latest"

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The restore script overwrites active configuration and workspace files, but the usage examples do not foreground that this is a destructive operation. Users may invoke restore expecting a safe preview and unintentionally replace current state, especially because the skill handles operational config files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The cleanup script permanently deletes expired backups automatically, contradicting the stated confirmation requirement for high-risk actions. Although retention cleanup is expected behavior, silent deletion reduces recovery options and may remove backups the user still needs.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · backup-scripts.md (reported line 176)May include surrounding context.
md
# 创建软链接到最新Skills备份 echo "🔗 更新最新Skills备份链接..." rm -f "$BACKUP_DIR/latest" ln -sf "$BACKUP_FILE" "$BACKUP_DIR/latest" echo " ✅ 最新Skills备份链接: $BACKUP_DIR/latest -> $BACKUP_FILE"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · backup-weekly-skills.sh (reported line 64)May include surrounding context.
sh
# 创建软链接到最新Skills备份 echo "🔗 更新最新Skills备份链接..." rm -f "$BACKUP_DIR/latest" ln -sf "$BACKUP_FILE" "$BACKUP_DIR/latest" echo " ✅ 最新Skills备份链接: $BACKUP_DIR/latest -> $BACKUP_FILE"

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata says it manages backups, but this script performs a full restore that overwrites the active ~/.openclaw state. That mismatch is dangerous because a user or calling agent may invoke the skill expecting low-risk backup maintenance, while it can replace configuration, memory, workspace contents, and agent state with attacker-controlled backup data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell-based operational behavior through required binaries and command examples, but it does not declare an explicit tool/permission scope. That creates ambiguity about what the agent is allowed to execute and weakens enforcement boundaries for a skill that can copy, delete, and restore files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill states backups must never be created automatically without user confirmation, yet elsewhere markets automated daily/weekly/monthly backups. This contradiction can cause agents or users to misapply the skill, leading to unintended collection and retention of potentially sensitive files without clear consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The rule says backups outside retention windows must not be deleted without confirmation, while the skill description claims expired backups are cleaned automatically. Ambiguous deletion semantics around retention can lead to unexpected data loss, especially because backup cleanup is inherently destructive.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
### 2. Follow Retention Policies / 遵循保留策略 **English**: Respect configured retention periods: daily (7 days), weekly (4 weeks), monthly (12 months). Never delete backups outside retention windows without confirmation. **中文**: 尊重配置的保留周期：每日（7天）、每周（4周）、每月（12个月）。未经确认，不得删除保留期之外的备份。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The user-facing comments and status/output strings throughout the script are in Chinese, which effectively forces a specific language for anyone invoking the skill. The file does not provide any opt-in, alternative locale, or justification that this is a region-specific tool, so it conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · backup-before-change.sh (reported line 85)May include surrounding context.
sh
echo -e " ${GREEN}✅ 关键备份创建成功: $(basename "$BACKUP_FILE") ($BACKUP_SIZE)${NC}" # 设置文件权限 chmod 600 "$BACKUP_FILE" # 记录原因 {

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · backup-now.sh (reported line 171)May include surrounding context.
sh
echo -e " ${GREEN}✅ 关键备份创建成功: $(basename "$BACKUP_FILE") ($BACKUP_SIZE)${NC}" # 设置文件权限 chmod 600 "$BACKUP_FILE" # 记录原因 {

Static analysis

No suspicious patterns detected.