ClawHub
Back to skill

Security audit

Claw Roam

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real workspace sync tool, but it can upload private OpenClaw memory, logs, skills, and configuration to a Git remote too broadly.

Review this carefully before installing. Use only a private, access-controlled Git remote, add a strict `.gitignore` or allowlist before first push, inspect staged files before every upload, and avoid the cron auto-push example unless you are comfortable with private workspace data being uploaded automatically. If any secret is pushed, deleting it later is not enough because Git history may retain it.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/claw-roam.sh:43
Finding

Indiscriminate Git staging can expose sensitive workspace data

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
SKILL.md:224
Finding

Recommended cron persistence performs recurring unreviewed data uploads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

resolved conflicts"

Or keep main's version

git checkout --theirs git add -A && git commit -m "merge: resolved conflicts"

text

## Simple Workflow: Local Primary + VPS Backup

For simpler setups without branches:

### Daily Usage (Local Mac)
Just use OpenClaw normally. Before shutdown:

```bash
claw-roam push "end of day sync"

Or let it auto-push via cron:

bash
# Add to crontab
*/10 * * * * cd ~/.openclaw/workspace && git add -A && git commit -m "auto: $(date)" && git push

Switching to VPS

  1. Ensure local has pushed: claw-roam push
  2. On VPS: claw-roam pull
  3. Update Telegram webhook to point to VPS (if using webhook mode)
  4. Continue using alternative bot token on VPS

Returning to Local

  1. On VPS: claw-roam push
  2. On local: claw-roam pull
  3. Update Telegram webhook back to local (if needed)

What Gets Synced

Synced (preserved across machines):

  • SOUL.md - Your agent's personality
  • MEMORY.md - Long-term memory
  • `memory/*.m

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly encourages syncing the entire OpenClaw workspace to a remote Git repository but does not provide a prominent warning that the workspace contains highly sensitive data such as memory, conversation logs, personality, skills, tokens, and operational context. Users may unknowingly upload private or credential-bearing files to third-party Git hosting, causing confidentiality loss and long-term persistence of sensitive data in commit history.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The setup flow directs users to initialize a repository in the workspace and commit everything, which can create durable session and state persistence across machines. In this skill's context, that persistence includes agent memory and context, increasing the chance that sensitive data is replicated, retained, and exposed beyond the original machine.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

git remote add origin

text

2. **Create initial commit**:
```bash
git add -A
git commit -m "initial"

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation explicitly states that memory files, conversation logs, skills, and context files are synchronized to a remote Git repository. This directs broad disclosure of user-provided and potentially secret data, and because Git preserves historical snapshots, accidental exposure can be durable even after later deletion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file is primarily written in English but includes Chinese instructional phrases such as '获取其他机器的最新内容' and '让其他机器能获取' in the middle of operational guidance. This introduces a language-specific requirement without user opt-in or justification, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.