ClawHub
Back to skill

Security audit

Molt

Security checks for vulnerabilities and agentic risk

Overview

This backup skill mostly does what it says, but it can repeatedly send sensitive OpenClaw memory, config, and schedule data to a git repository with broad opt-in scope and limited safeguards.

Install only if you deliberately want OpenClaw brain files, memory, cron metadata, and redacted config snapshots stored in a private git repository you control. Prefer SSH or a credential helper over tokens in URLs, run a dry run first, inspect the generated backup contents before the first push, avoid extra directories unless you have reviewed them, and remove the cron job when you no longer want automatic backups.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly describes shell execution, file copying, git clone/push, and cron setup, but it does not declare permissions accordingly. This creates a governance and review gap: an agent or platform may invoke a skill with write and shell capabilities that were not transparently surfaced to the user or policy engine. Because the skill exfiltrates local brain files to a remote repository, undeclared capabilities materially increase risk.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The script adds cron-job discovery/export behavior that is not necessary for a narrowly scoped brain-backup skill. In this context, enumerating scheduler state can expose operational metadata, task messages, and error details that may contain sensitive information and broadens the skill's access beyond its declared purpose.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Calling `openclaw cron list --all --json` enumerates all cron jobs, which is an unnecessary capability for simple offsite backup of brain files. The exported JSON and generated Markdown include job names, schedules, status, task messages, and errors, which can leak internal workflow details or secrets embedded in job payloads.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script exports cron jobs and a redacted OpenClaw configuration to the backup repository, even though the skill description centers on backing up brain files. Cron schedules and configuration metadata can reveal host behavior, file paths, operational details, and potentially sensitive settings; if redaction is incomplete or the backup repo is broadly accessible, this expands data exposure beyond the user’s likely expectation.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The --extra-dirs / MOLT_EXTRA_DIRS feature allows backing up arbitrary workspace subdirectories in addition to the named brain files. In a backup skill that pushes offsite to git, this increases the risk of unintentionally exfiltrating unrelated sensitive material from the workspace, especially if users or higher-level agents supply broad directory names without understanding the contents.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases are broad enough that ordinary requests about backups, snapshots, or scheduling could auto-select this skill even when the user did not intend to push sensitive local state to an offsite git repository. In this context, accidental invocation is significant because the skill handles high-value files like memory, identity, and configuration exports. The danger comes from overbroad activation leading to unintended data transfer.

Session Persistence

Medium
Category
Rogue Agent
Content
- **HTTPS with token**: configure a credential helper or use a token in the URL (`https://<token>@github.com/...`)
  - `gh` CLI is **not required** — molt uses plain git only
- **`rsync`** — used for `memory/` sync; standard on macOS and most Linux distros
- **Write access to the remote repo** — the pushing account needs push rights; a dedicated private repo is recommended

No other dependencies. No OpenClaw-specific CLI tools needed at runtime.
Confidence
90% confidence
Finding
The skill establishes durable session persistence by relying on stored git credentials, local clone state, and an offsite remote that continues receiving snapshots after initial setup. This is security-relevant because once configured, future runs can silently export updated brain data without re-supplying the repo URL, and the documentation even suggests embedding HTTPS tokens in URLs. In a skill dedicated to backing up sensitive agent state, persistence increases the blast radius of mistaken or abused invocation.

Session Persistence

Medium
Category
Rogue Agent
Content
## Scheduling

To schedule automatic backups, create a cron job pointing at this script. Example for every 6 hours:

```
0 */6 * * * MOLT_DIR=~/.openclaw/molt ~/.openclaw/workspace/marv-skills/molt/scripts/molt.sh >> /tmp/molt.log 2>&1
Confidence
95% confidence
Finding
The skill explicitly instructs users to create a cron job for recurring execution, which turns a one-time action into persistent automated behavior. Persistent scheduled backups of memory, identity, and config-derived data materially raise risk because a misconfigured or compromised destination will continue receiving sensitive snapshots without fresh user review. The skill context makes this more dangerous, not less, because the entire purpose is recurring offsite replication of valuable local state.

Static analysis

No suspicious patterns detected.