Duplicati Backup Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:45 AM UTC
• Version: 0.1.0

Overview

The skill does what it claims, but its setup encourages a long-lived backup-administration token to be used over plain HTTP without adequate safety guidance.

Review before installing. Use this only against a Duplicati endpoint protected by HTTPS, a trusted local tunnel, or another encrypted channel; avoid plain HTTP server URLs. Treat DUPLICATI_TOKEN as an administrative secret, store it in a protected secret source rather than shared plaintext config where possible, restrict file permissions, and rotate or revoke it if exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:7

Finding

Long-Lived Bearer Token Transmitted over Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7-8, 17, 22, 28, 34, 40; README.md:31-32, 40-57
Vulnerability Type: Plaintext transmission of a sensitive authentication credential
Risk Level: High

Vulnerable Code

SKILL.md defines an HTTP endpoint, requires a ten-year bearer token, and includes that token in every API request:

md

- DUPLICATI_URL    # e.g., http://0.0.0.0:8200
- DUPLICATI_TOKEN  # Your generated 10-year Forever Token

md

**Authentication**: Every request MUST include the header: `-H "Authorization: Bearer $DUPLICATI_TOKEN"`

md

`curl -s -H "Authorization: Bearer $DUPLICATI_TOKEN" "$DUPLICATI_URL/api/v1/serverstate"`

md

`curl -s -H "Authorization: Bearer $DUPLICATI_TOKEN" "$DUPLICATI_URL/api/v1/backups"`

md

`curl -s -X POST -H "Authorization: Bearer $DUPLICATI_TOKEN" "$DUPLICATI_URL/api/v1/backup/{ID}/start"`

md

`curl -s -H "Authorization: Bearer $DUPLICATI_TOKEN" "$DUPLICATI_URL/api/v1/backup/{ID}/log?pagesize=5"`

README.md likewise directs users to configure a plain HTTP server URL with a long-lived token:

json

"duplicati": {
  "enabled": true,
  "env": {
    "DUPLICATI_URL": "[http://YOUR_SERVER_IP:8200]",
    "DUPLICATI_TOKEN": "YOUR_GENERATED_FOREVER_TOKEN"
  }
}

md

Since Duplicati uses secure JWT tokens, you must generate a "Forever Token" to allow the OpenClaw agent to talk to the server.

**1.Enable Token Issuance**: On your Duplicati server, stop the service and restart it briefly with the enable flag:

###### If using systemd

sudo systemctl stop duplicati duplicati-server --webservice-enable-forever-token=true

text

**2.Generate the Token**: In a second terminal on the same server, run the utility to issue your 10-year token:

duplicati-server-util issue-forever-token

text

Copy the long string it spits out. This is your `DUPLICATI_TOKEN`.

Te

...[truncated 2754 chars]

Remediation

View remediation

Remediation Suggestions

1. Require DUPLICATI_URL to use https:// and retain normal TLS certificate and hostname verification.
2. Reject plain HTTP endpoints by default. If local development support is essential, restrict any exception to an explicitly approved loopback address and display a security warning.
3. Replace the 0.0.0.0 client URL example with an HTTPS hostname whose certificate can be validated.
4. If Duplicati cannot directly provide TLS, place it behind a properly configured TLS reverse proxy or access it through an authenticated, encrypted tunnel.
5. Prefer short-lived, revocable credentials over ten-year “Forever Tokens.” Rotate existing tokens after transport security is deployed.
6. Scope the credential to only the operations required by this Skill where Duplicati supports granular authorization.
7. Store the token only in a protected secret-management facility or restricted environment configuration. Do not print it in logs, command traces, status output, or error reports.
8. Document token revocation and incident-response procedures so an intercepted credential can be invalidated promptly.
9. Consider validating the configured URL before every request and failing closed for unsupported schemes, malformed destinations, embedded credentials, or unexpected hosts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README directs users to generate a 10-year 'Forever Token' and store it in configuration without emphasizing that it is a highly sensitive bearer credential or recommending secure storage, rotation, or scope limitation. Because bearer tokens grant access to backup-management APIs, theft of this token could let an attacker enumerate backups, read operational details, trigger jobs, or potentially alter backup state, making the long lifetime especially risky.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

If using systemd

text

sudo systemctl stop duplicati
duplicati-server --webservice-enable-forever-token=true

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

If using systemd

text

sudo systemctl stop duplicati
duplicati-server --webservice-enable-forever-token=true

Static analysis

No suspicious patterns detected.