Multi-Device Sync via GitHub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:52 AM UTC
• Version: 1.0.2

Overview

This skill is a real GitHub sync tool, but it asks users to run mutable remote shell code and defaults to syncing sensitive agent memory, instructions, and skills through a persistent background process.

Review this skill carefully before installing. Use the clone-and-inspect path instead of curl-to-bash, use a private repository with tightly controlled write access, avoid syncing SOUL.md, MEMORY.md, memory/, or skills/ unless you intentionally want remote repository changes to affect future agent behavior, and do not run the daemon until you understand the auto-push and auto-pull behavior.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Unpinned Remote Script Execution Through curl-to-shell Installation

Content

View full analysis

⚠️ **Security Note**: This method executes remote code. Only use if you trust the source. ``` `references/troubleshooting.md:159-165`: ```bash curl -fsSL https://raw.githubusercontent.com/RegulusZ/multi-device-sync-github/main/install.sh | \ REPO_URL="[e-mail]:USER/openclaw_sync.git" \ DEVICE_NAME="mydevice" \ SYNC_MODE="first" \ bash ``` ### Technical Analysis These instructions download `install.sh` from the mutable `main` branch of a personal GitHub repository and immediately execute the response with Bash. No immutable commit identifier, signature, checksum, or release artifact verification is used. Consequently, the code reviewed in this package is not necessarily the code that will execute at installation time. The payload can change after review if the upstream branch is updated or if the repository, maintainer account, DNS path, delivery infrastructure, or user network is compromised. This behavior is not necessary for the declared synchronization functionality. The project already documents a safer clone-and-review installation method. Executing a mutable response directly also prevents meaningful inspection and makes partial-download or unexpected-response behavior harder to diagnose. The downloaded installer operates with the invoking user's authority and can also request elevated package-management access on Linux: ```bash sudo apt-get update -qq sudo ...[truncated 1388 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/sync-init.sh:54

Finding

Remote Repository Can Persistently Poison Agent Instructions, Memory, and Skills

Content

View full analysis

/dev/null || { echo "Warning: Failed to fetch from origin (network issue?)" exit 0 } ... if git pull --rebase origin "$MAIN_BRANCH" 2>/dev/null; then echo "✓ Pulled remote changes at $(date '+%H:%M:%S')" ``` ### Technical Analysis The defaul ...[truncated 2402 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync-init.sh:127

Finding

Unvalidated Synchronization Paths Permit Directory Traversal and Destructive File Replacement

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sync-init.sh:169

Finding

Directory Merge Deletes Same-Named Local Files Without Backing Them Up

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (38)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

./install.sh

text

This method is **safer** than `curl | bash` because:
- You can review the code before running
- The script runs locally, not from a remote source
- You can verify the repository integrity

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping network-fetched content directly into bash is a classic command-chaining anti-pattern because it executes untrusted remote content without validation, review, or integrity checking. In the context of a synchronization skill likely to be installed on multiple devices, a compromised installer could achieve broad code execution across a user's fleet.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

For trusted environments, one-line install:

bash

curl -fsSL https://raw.githubusercontent.com/RegulusZ/multi-device-sync-github/main/install.sh | bash

⚠️ Security Note: This method executes remote code. Only use if you trust the source.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The static analysis indicates notifier behavior writing into local notification paths that is not clearly reflected in the top-level description. Hidden or under-described side effects reduce transparency and can mask local data handling or message generation that operators did not expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The static analysis indicates notifier behavior writing into local notification paths that is not clearly reflected in the top-level description. Hidden or under-described side effects reduce transparency and can mask local data handling or message generation that operators did not expect.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using '| bash' creates an immediate command chain from network input to shell execution, removing any review checkpoint. In a skill that also requests filesystem access, git credentials, and potentially sudo-installed dependencies, this can lead to full compromise of the local environment if the fetched content is malicious.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Interactive Installation (Recommended)

bash

curl -fsSL https://raw.githubusercontent.com/RegulusZ/multi-device-sync-github/main/install.sh | bash

The installer will guide you through:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The add-device flow again chains remote download directly into bash, making compromise of the upstream script an instant code-execution vector on each additional machine. Since the skill is specifically multi-device, this pattern can amplify a single upstream compromise across all synchronized endpoints.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Option A: Interactive

bash

curl -fsSL https://raw.githubusercontent.com/RegulusZ/multi-device-sync-github/main/install.sh | bash
# Select "Add to existing sync"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The usage comment promotes a pipe-to-shell installation pattern (effectively curl/wget | bash), which encourages users to execute unreviewed remote shell code directly. In this skill’s context, that is especially risky because the installer also performs package installation, clones repositories, executes fetched scripts, and starts a background daemon, amplifying the consequences of a compromised or modified install source.

Content

Scanner excerpt · install.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# Multi-Device Sync for OpenClaw - Interactive Installer
# Usage:  bash| bash

set -e

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/troubleshooting.md (reported line 108)May include surrounding context.

nano ~/.config/openclaw/sync-config.yaml

Change device_name

Re-initialize (will not overwrite existing files)

sync-init --device-name NEWNAME

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

rm -rf skills/some-skill/.git is a forceful destructive command that removes repository metadata recursively, and documentation users may adapt the path manually and make mistakes. In this skill context, the command is presented as a remediation step, which makes accidental misuse more plausible even if the intent is not malicious.

Content

Scanner excerpt · references/troubleshooting.md (reported line 147)May include surrounding context.

bash

cd ~/openclaw-sync
# Remove nested .git
rm -rf skills/some-skill/.git
# Commit the fix
git add -A && git commit -m "fix: remove nested git repo"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

git reset --hard origin/main is a high-risk command because it forcefully rewrites the working tree and index to match the remote, deleting local modifications. In a synchronization troubleshooting guide, stressed users may run this immediately, causing preventable data loss if they have not validated backups or understood the consequences.

Content

Scanner excerpt · references/troubleshooting.md (reported line 191)May include surrounding context.

md

# 3. Reset to remote
cd ~/openclaw-sync
git fetch origin
git reset --hard origin/main

# 4. Re-apply local changes manually
# (from backup)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script performs rm -rf on paths derived from SYNC_FILES without strong validation that each item is an expected safe relative path under the workspace. If a caller supplies crafted values such as path traversal components or unexpected absolute-like entries, the script could delete arbitrary user files or directories outside the intended sync scope, especially when confirmations are skipped.

Content

Scanner excerpt · scripts/sync-init.sh (reported line 197)May include surrounding context.

sh

# === SAFETY: Only remove what we've backed up ===
    if [[ -e "$WORKSPACE_DIR/$item_name" && ! -L "$WORKSPACE_DIR/$item_name" ]]; then
        # Remove original (already backed up above)
        rm -rf "$WORKSPACE_DIR/$item_name"
    fi
    
    # Create symlink

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents shell-based installation and management commands but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and can cause an agent or user to underestimate that the skill performs package installation, git operations, and daemon management on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill promotes syncing OpenClaw workspace data to GitHub without presenting a prominent upfront warning that this may transmit sensitive profile, memory, and log data off-machine. Because the synced content is likely to contain personal and operational context, users may expose more than intended even when using a private repository.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill instructs users to run sudo apt-get install, which invokes privileged package installation on the host. While common for setup, it still expands risk because a user following bundled instructions may grant elevated privileges as part of an unreviewed workflow tied to third-party code.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt-get install -y git inotify-tools

macOS

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The quick-start instruction pipes a remote script directly into bash, which executes unreviewed code fetched at runtime. If the repository, maintainer account, transport, or referenced branch is compromised, users can suffer immediate arbitrary code execution on their machine.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The manual installation flow initializes a local sync repository and starts a daemon that persists as an ongoing synchronization mechanism. Persistent background behavior and long-lived filesystem integration increase attack surface and the chance of unintended ongoing data transmission or tampering.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

# 1. Clone skill
git clone https://github.com/RegulusZ/multi-device-sync-github.git ~/openclaw-skills/multi-device-sync-github

# 2. Clone/create sync repo
git clone [e-mail]:YOURNAME/openclaw_sync.git ~/openclaw-sync

# 3. Initialize

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The described auto-push flow continuously commits and pushes changed workspace content to GitHub after a short debounce. This converts local edits into ongoing outbound transmission, increasing the chance that sensitive or accidental content is exfiltrated before the user notices.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly recommends syncing files like USER.md, MEMORY.md, SOUL.md, skills, and memory logs to GitHub. In this context, those files can contain personal data, secrets, operational notes, or behavioral instructions, so normalizing their automatic remote synchronization creates a meaningful data leakage risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation is internally inconsistent about whether auto-push is enabled by default. For a feature that continuously transmits workspace changes to GitHub, ambiguity can directly lead to accidental data exposure because users may rely on the safer stated default when the effective behavior differs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The permissions section acknowledges write access to the OpenClaw workspace and git push access to a remote repository, implying durable modification and persistence of user data and sync behavior. In context, this is not covert malware persistence, but it is still security-relevant because it establishes ongoing control over local content and remote updates.

Content

Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.

md

### Permissions

The skill requires:
- Read/write access to `~/.openclaw/workspace/`
- Git push access to your sync repository
- No network access beyond GitHub

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installer’s prompt implies the user can enable automatic push, but the case statement sets AUTO_PUSH="false" for both yes and no paths. This causes the installer to misrepresent security-relevant behavior and can lead users to believe sync automation is configured differently than it actually is, undermining operator control and potentially causing unsafe assumptions during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The installer clones and pulls a remote skill repository, then immediately executes scripts from it and starts a background daemon, all without an explicit trust warning, version pinning, or integrity verification. This creates a software supply-chain risk where a compromised upstream repo or man-in-the-middle in a trusted environment could result in arbitrary code execution and persistent background activity on the user’s machine.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script claims it will start only a pull daemon when auto-push is disabled, but both branches execute the same daemon start command. This is dangerous because users may disable auto-push expecting to prevent outbound sync of sensitive files, while the actual daemon behavior may still include push functionality depending on downstream implementation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 11)May include surrounding context.

Linux:

bash

sudo apt-get install inotify-tools

macOS:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting instructions tell the user to run rm -rf skills/some-skill/.git without an explicit warning that this permanently removes repository metadata and cannot be undone easily. Even though the path is scoped, recursive forced deletion in documentation creates a real risk of accidental destructive use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.