Openclaw Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:39 AM UTC
• Version: 1.1.0

Overview

This is a coherent backup and restore skill, but its restore flow and backup handling can expose or overwrite highly sensitive OpenClaw data without enough safeguards.

Only install or use this skill if you understand that its backups may contain API keys, tokens, sessions, workspace files, and scheduled tasks. Store archives in a private encrypted location, avoid shared or synced directories unless encrypted, and restore only archives you created and verified. Treat restore as high impact because it can overwrite current OpenClaw state and load restored agent configuration or scheduled tasks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restore.sh:8

Finding

Unvalidated Archive Extraction into the User Home Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/restore.sh:8-33
Vulnerability Type: Unsafe archive extraction
Risk Level: High

bash

BACKUP_FILE="${1:-$LATEST_BACKUP}"

if [ -z "$BACKUP_FILE" ]; then
    echo "❌ No backup found in $BACKUP_DIR"
    exit 1
fi

if [ ! -f "$BACKUP_FILE" ]; then
    echo "❌ Backup file not found: $BACKUP_FILE"
    exit 1
fi

echo "📦 Restoring from: $BACKUP_FILE"

# Stop gateway
echo "🛑 Stopping gateway..."
openclaw gateway stop

# Backup current state
if [ -d "$HOME/.openclaw" ]; then
    mv "$HOME/.openclaw" "$HOME/.openclaw-pre-restore-$(date +%Y%m%d_%H%M)"
    echo "✅ Current state backed up to ~/.openclaw-pre-restore-*"
fi

# Extract backup
tar -xzf "$BACKUP_FILE" -C "$HOME"

Technical Analysis

The script accepts an arbitrary archive path from its first argument and validates only that the path refers to a regular file. It does not verify the archive's provenance, expected directory structure, member paths, file types, symbolic links, hard links, ownership metadata, or integrity before extracting it directly into $HOME.

A malicious archive can contain absolute paths, traversal components such as ../, unsafe links, special files, or entries outside the expected .openclaw/ hierarchy. Depending on the behavior and version of the installed tar, these entries may overwrite or create files elsewhere under the invoking user's accessible filesystem.

Even where path traversal protections prevent direct writes outside the extraction directory, an attacker-controlled archive can replace OpenClaw configuration, credentials, agent definitions, workspace state, Telegram session data, or scheduled-task definitions. The script then restarts the gateway, causing restored attacker-controlled state to be consumed.

Attack Path

1. An attacker creates a crafted .tar.gz archive containing malicious paths, links, or attacker-controlled files under ...[truncated 1185 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every supplied backup archive as untrusted until it has been validated.
• List and inspect archive members before extraction. Reject:
  • Absolute paths.
  • Empty or malformed member names.
  • Any .. path component.
  • Entries outside the expected .openclaw/ top-level directory.
  • Symbolic links, hard links, device nodes, FIFOs, and other unexpected file types.
• Extract into a newly created private temporary directory with mode 0700, rather than directly into $HOME.
• Use restrictive extraction options supported by the deployed tar, including disabling restoration of archive ownership and avoiding unsafe permission metadata.
• After extraction, verify that the staged tree contains only expected paths and that all resolved paths remain inside the staging directory.
• Authenticate backups with a signature or MAC and restore only archives from a trusted source.
• Replace the existing .openclaw directory atomically only after validation and successful staging.
• Check whether openclaw gateway stop succeeded before modifying the current state.
• If extraction or validation fails, restore the previous state automatically and avoid restarting the gateway with a partial tree.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.sh:5

Finding

Sensitive Backup Archives Are Created Without Enforced Access Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh:5-13
Vulnerability Type: Insecure storage of sensitive information
Risk Level: Medium

bash

BACKUP_DIR="${1:-$HOME/openclaw-backups}"
DATE=$(date +%Y-%m-%d_%H%M)
BACKUP_FILE="$BACKUP_DIR/openclaw-$DATE.tar.gz"

mkdir -p "$BACKUP_DIR"

# Create backup (exclude completions cache and logs)
tar -czf "$BACKUP_FILE" \
    --exclude='completions' \
    --exclude='*.log' \
    -C "$HOME" .openclaw/ 2>/dev/null

Technical Analysis

The backup intentionally includes highly sensitive OpenClaw data, including API keys, tokens, authentication profiles, Telegram sessions, agent state, workspace memory, and user files. The script creates the destination directory and archive without first setting a restrictive umask or explicitly enforcing secure ownership and permissions.

Consequently, the archive's effective permissions depend on the caller's ambient umask and the security of any existing destination directory. A permissive environment may produce an archive readable by other local users or services. The optional destination argument also permits storage in a shared, synchronized, externally mounted, or attacker-controlled directory.

The script does not reject a symbolic-link destination, confirm that the directory is owned by the invoking user, or encrypt the archive. Compression does not provide confidentiality.

Attack Path

1. The backup script runs with a permissive umask, or the user selects an insecure shared or synchronized destination.
2. mkdir -p accepts the destination without checking its ownership, mode, or whether path components are symbolic links.
3. tar writes an unencrypted archive containing credentials, tokens, sessions, configuration, memory, and user files.
4. Another local principal, process, synchronization recipient, or party with access to the destination reads the archive.
5. Extracted credentials and se ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

• Set umask 077 before creating the backup directory or archive.
• Require the backup directory to be owned by the invoking user and to have mode 0700.
• Create each archive with mode 0600 and verify its final owner and permissions.
• Reject destinations that are symbolic links, unexpectedly shared, world-writable, or owned by another account.
• Resolve and validate the destination path before writing, including all parent path components.
• Warn users that the archive contains credentials and session material.
• Support authenticated encryption for portable, synchronized, removable-media, or off-host backups.
• Store encryption keys separately from the archive and use an established authenticated-encryption tool rather than custom cryptography.
• Consider excluding credentials and session material by default, with an explicit option when a full disaster-recovery backup is required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code substantially matches the backup portion of the description: it archives ~/.openclaw, applies exclusions, and performs rotation. However, the declared purpose explicitly includes restore-from-backup and setting up automatic backup schedules, neither of which is implemented in this code chunk. This is a description-to-behavior mismatch because important declared capabilities are absent from the actual code.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The command 'rm -rf ~/.openclaw' recursively deletes the entire OpenClaw state, which includes credentials, agent configs, workspace contents, and scheduled tasks. In context this is part of a rollback procedure, but if followed incorrectly or after a failed earlier step, it can permanently destroy user data and secrets without validation or confirmation.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The command 'rm -rf ~/.openclaw' recursively deletes the entire OpenClaw state, which includes credentials, agent configs, workspace contents, and scheduled tasks. In context this is part of a rollback procedure, but if followed incorrectly or after a failed earlier step, it can permanently destroy user data and secrets without validation or confirmation.

Content

Scanner excerpt · references/restore.md (reported line 26)May include surrounding context.

Rollback if Restore Fails

bash

rm -rf ~/.openclaw
mv ~/.openclaw-old ~/.openclaw
openclaw gateway start

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The rotation pipeline uses ls ... | tail | xargs rm, which is unsafe for filenames containing whitespace, newlines, or shell-special characters and can delete unintended files. Because BACKUP_DIR is user-controlled via the first script argument, an attacker or careless caller could point the script at a directory with crafted matching filenames and trigger incorrect deletions during backup rotation.

Content

Scanner excerpt · scripts/backup.sh (reported line 21)May include surrounding context.

sh

SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    
    # Rotate: keep only last 7 backups
    ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm
    
    COUNT=$(ls "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | wc -l)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: openclaw-backup
description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions.
---

# OpenClaw Backup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The backup instructions explicitly include credentials, tokens, session data, agent auth profiles, and user workspace files, but they do not warn that the resulting archive is highly sensitive. Users may store or transmit the archive insecurely, turning a routine backup into a single-file compromise of accounts, sessions, and private data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The restore steps replace the live ~/.openclaw state after stopping the gateway and renaming the current directory, but they do not clearly warn about rollback, compatibility, or data loss risks. An operator may restore the wrong archive or overwrite a newer state, causing loss of credentials, workspace contents, or service availability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore and rollback instructions perform destructive replacement of the user's live ~/.openclaw directory, including moving the current state aside and later deleting/restoring data, but they do not prominently warn about overwrite, rollback limitations, or the risk of losing changes made since the backup. In a backup/restore skill this behavior is expected, but the lack of explicit safety guidance makes accidental data loss more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.