Openclaw Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:39 AM UTC
• Version: 1.1.0

Overview

This is a coherent backup and restore skill, but its restore flow and backup handling can expose or overwrite highly sensitive OpenClaw data without enough safeguards.

Only install or use this skill if you understand that its backups may contain API keys, tokens, sessions, workspace files, and scheduled tasks. Store archives in a private encrypted location, avoid shared or synced directories unless encrypted, and restore only archives you created and verified. Treat restore as high impact because it can overwrite current OpenClaw state and load restored agent configuration or scheduled tasks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restore.sh:8
• Finding: Unvalidated Archive Extraction into the User Home Directory## Vulnerability Details **File Location**: `scripts/restore.sh:8-33` **Vulnerability Type**: Unsafe archive extraction **Risk Level**: High ```bash BACKUP_FILE="${1:-$LATEST_BACKUP}" if [ -z "$BACKUP_FILE" ]; then echo "❌ No backup found in $BACKUP_DIR" exit 1 fi if [ ! -f "$BACKUP_FILE" ]; then echo "❌ Backup file not found: $BACKUP_FILE" exit 1 fi echo "📦 Restoring from: $BACKUP_FILE" # Stop gateway echo "🛑 Stopping gateway..." openclaw gateway stop # Backup current state if [ -d "$HOME/.openclaw" ]; then mv "$HOME/.openclaw" "$HOME/.openclaw-pre-restore-$(date +%Y%m%d_%H%M)" echo "✅ Current state backed up to ~/.openclaw-pre-restore-*" fi # Extract backup tar -xzf "$BACKUP_FILE" -C "$HOME" ``` ### Technical Analysis The script accepts an arbitrary archive path from its first argument and validates only that the path refers to a regular file. It does not verify the archive's provenance, expected directory structure, member paths, file types, symbolic links, hard links, ownership metadata, or integrity before extracting it directly into `$HOME`. A malicious archive can contain absolute paths, traversal components such as `../`, unsafe links, special files, or entries outside the expected `.openclaw/` hierarchy. Depending on the behavior and version of the installed `tar`, these entries may overwrite or create files elsewhere under the invoking user's accessible filesystem. Even where path traversal protections prevent direct writes outside the extraction directory, an attacker-controlled archive can replace OpenClaw configuration, credentials, agent definitions, workspace state, Telegram session data, or scheduled-task definitions. The script then restarts the gateway, causing restored attacker-controlled state to be consumed. ### Attack Path 1. An attacker creates a crafted `.tar.gz` archive containing malicious paths, links, or attacker-controlled files under ...[truncated 1185 chars]
• Remediation: ## Remediation Suggestions - Treat every supplied backup archive as untrusted until it has been validated. - List and inspect archive members before extraction. Reject: - Absolute paths. - Empty or malformed member names. - Any `..` path component. - Entries outside the expected `.openclaw/` top-level directory. - Symbolic links, hard links, device nodes, FIFOs, and other unexpected file types. - Extract into a newly created private temporary directory with mode `0700`, rather than directly into `$HOME`. - Use restrictive extraction options supported by the deployed `tar`, including disabling restoration of archive ownership and avoiding unsafe permission metadata. - After extraction, verify that the staged tree contains only expected paths and that all resolved paths remain inside the staging directory. - Authenticate backups with a signature or MAC and restore only archives from a trusted source. - Replace the existing `.openclaw` directory atomically only after validation and successful staging. - Check whether `openclaw gateway stop` succeeded before modifying the current state. - If extraction or validation fails, restore the previous state automatically and avoid restarting the gateway with a partial tree.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.sh:5
• Finding: Sensitive Backup Archives Are Created Without Enforced Access Controls## Vulnerability Details **File Location**: `scripts/backup.sh:5-13` **Vulnerability Type**: Insecure storage of sensitive information **Risk Level**: Medium ```bash BACKUP_DIR="${1:-$HOME/openclaw-backups}" DATE=$(date +%Y-%m-%d_%H%M) BACKUP_FILE="$BACKUP_DIR/openclaw-$DATE.tar.gz" mkdir -p "$BACKUP_DIR" # Create backup (exclude completions cache and logs) tar -czf "$BACKUP_FILE" \ --exclude='completions' \ --exclude='*.log' \ -C "$HOME" .openclaw/ 2>/dev/null ``` ### Technical Analysis The backup intentionally includes highly sensitive OpenClaw data, including API keys, tokens, authentication profiles, Telegram sessions, agent state, workspace memory, and user files. The script creates the destination directory and archive without first setting a restrictive `umask` or explicitly enforcing secure ownership and permissions. Consequently, the archive's effective permissions depend on the caller's ambient `umask` and the security of any existing destination directory. A permissive environment may produce an archive readable by other local users or services. The optional destination argument also permits storage in a shared, synchronized, externally mounted, or attacker-controlled directory. The script does not reject a symbolic-link destination, confirm that the directory is owned by the invoking user, or encrypt the archive. Compression does not provide confidentiality. ### Attack Path 1. The backup script runs with a permissive `umask`, or the user selects an insecure shared or synchronized destination. 2. `mkdir -p` accepts the destination without checking its ownership, mode, or whether path components are symbolic links. 3. `tar` writes an unencrypted archive containing credentials, tokens, sessions, configuration, memory, and user files. 4. Another local principal, process, synchronization recipient, or party with access to the destination reads the archive. 5. Extracted credentials and se ...[truncated 686 chars]
• Remediation: ## Remediation Suggestions - Set `umask 077` before creating the backup directory or archive. - Require the backup directory to be owned by the invoking user and to have mode `0700`. - Create each archive with mode `0600` and verify its final owner and permissions. - Reject destinations that are symbolic links, unexpectedly shared, world-writable, or owned by another account. - Resolve and validate the destination path before writing, including all parent path components. - Warn users that the archive contains credentials and session material. - Support authenticated encryption for portable, synchronized, removable-media, or off-host backups. - Store encryption keys separately from the archive and use an established authenticated-encryption tool rather than custom cryptography. - Consider excluding credentials and session material by default, with an explicit option when a full disaster-recovery backup is required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The code substantially matches the backup portion of the description: it archives ~/.openclaw, applies exclusions, and performs rotation. However, the declared purpose explicitly includes restore-from-backup and setting up automatic backup schedules, neither of which is implemented in this code chunk. This is a description-to-behavior mismatch because important declared capabilities are absent from the actual code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## Rollback if Restore Fails

```bash
rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start
```

• Confidence: 90% confidence
• Finding: The command 'rm -rf ~/.openclaw' recursively deletes the entire OpenClaw state, which includes credentials, agent configs, workspace contents, and scheduled tasks. In context this is part of a rollback procedure, but if followed incorrectly or after a failed earlier step, it can permanently destroy user data and secrets without validation or confirmation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## Rollback if Restore Fails

```bash
rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start
```

• Confidence: 90% confidence
• Finding: The command 'rm -rf ~/.openclaw' recursively deletes the entire OpenClaw state, which includes credentials, agent configs, workspace contents, and scheduled tasks. In context this is part of a rollback procedure, but if followed incorrectly or after a failed earlier step, it can permanently destroy user data and secrets without validation or confirmation.

Chaining Abuse

High

• Category: Tool Misuse

Content

SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

• Confidence: 87% confidence
• Finding: The rotation pipeline uses `ls ... | tail | xargs rm`, which is unsafe for filenames containing whitespace, newlines, or shell-special characters and can delete unintended files. Because `BACKUP_DIR` is user-controlled via the first script argument, an attacker or careless caller could point the script at a directory with crafted matching filenames and trigger incorrect deletions during backup rotation.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
---

# OpenClaw Backup

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The backup instructions explicitly include credentials, tokens, session data, agent auth profiles, and user workspace files, but they do not warn that the resulting archive is highly sensitive. Users may store or transmit the archive insecurely, turning a routine backup into a single-file compromise of accounts, sessions, and private data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The restore steps replace the live ~/.openclaw state after stopping the gateway and renaming the current directory, but they do not clearly warn about rollback, compatibility, or data loss risks. An operator may restore the wrong archive or overwrite a newer state, causing loss of credentials, workspace contents, or service availability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The restore and rollback instructions perform destructive replacement of the user's live ~/.openclaw directory, including moving the current state aside and later deleting/restoring data, but they do not prominently warn about overwrite, rollback limitations, or the risk of losing changes made since the backup. In a backup/restore skill this behavior is expected, but the lack of explicit safety guidance makes accidental data loss more likely.

Static analysis

No suspicious patterns detected.