ClawHub
Back to skill

Security audit

Elegant Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real backup/sync tool, but it handles sensitive OpenClaw data and repository tokens in ways that can expose data or allow unsafe command execution.

Review this carefully before installing. Only use it with a private, access-controlled repository and a narrowly scoped token, and do not run sync until command construction, recursive secret filtering, token handling, confirmation prompts, and restore documentation are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:288
Finding

Shell Command Injection Through Untrusted Backup Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.js:196
Finding

Recursive Skill Backup Bypasses Secret and Gitignore Exclusions

Content
View full analysis
{ if (!fs.existsSync(src)) return false; if (shouldIgnore(src, ignorePatterns)) return false; if (dryRun) { log(` ${name}`, 'blue'); } else { fs.mkdirSync(path.dirname(dest), { recursive: true }); if (fs.statSync(src).isDirectory()) { fs.cpSync(src, dest, { recursive: true }); } else { fs.copyFileSync(src, dest); } log(` ${name}`, 'green'); } files.push(name); return true; }; ``` Entire Skill directories are passed to that helper: ```js const skillsDir = path.join(WORKSPACE_DIR, 'skills'); if ( fs.existsSync(skillsDir) && (target === 'all' || target === 'skills') ) { fs.mkdirSync( path.join(STAGING_DIR, instanceDir, 'skills'), { recursive: true } ); for (const skill of fs.readdirSync(skillsDir)) { const skillPath = path.join(skillsDir, skill); if (fs.statSync(skillPath).isDirectory()) { copyIfExists( skillPath, path.join(STAGING_DIR, instanceDir, 'skills', skill), `skills/${skill}` ); } } } ``` ### Technical Analysis The built-in denylist does not explicitly include `.env`, `openclaw.json`, credential directories, private keys, or common token files, despite the documentation claiming that `.env` and `openclaw. ...[truncated 1293 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.js:288
Finding

Repository Access Token Exposed in Git Process Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.js:217
Finding

Sensitive Agent State Can Be Uploaded Without Repository Privacy Enforcement

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

md
## 安全特性

- 不上传 .env 和 openclaw.json
- URL 验证
- Token 不出现在错误信息中
- 本地备份后再恢复

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
## 安全特性

- 不上传 .env 和 openclaw.json
- URL 验证
- Token 不出现在错误信息中
- 本地备份后再恢复

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is presented as a 'safe' configuration sync tool, but the documented behavior includes sending highly sensitive workspace data, identity/configuration files, and custom skills to a remote Git repository using an authentication token. That is a material capability beyond a benign local sync description, and the mismatch reduces informed user consent while increasing the risk of unintended data exfiltration.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The branch name used in the shell command comes from getInstanceId(), which reads INSTANCE_ID from ~/.openclaw/.backup.env or falls back to hostname, and that value is interpolated directly into an execSync shell string. An attacker who can influence INSTANCE_ID or hostname can inject shell metacharacters and execute arbitrary commands when sync runs, making this a real command-injection issue with potentially full user-level code execution.

Content

Scanner excerpt · index.js (reported line 284)May include surrounding context.

js
const tag = generateTag();
  const branch = getInstanceId();
  safeExec(`git push ${repoUrl} HEAD:${branch} --force`);
  safeExec(`git tag ${tag}`);
  safeExec(`git push ${repoUrl} ${tag}`);

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README instructs users to place a GitHub token in a local config file but does not warn about least-privilege scopes, rotation, filesystem permissions, or the risk of accidental inclusion in backups or shell history. For a backup/sync skill that handles repositories, this omission can lead to credential exposure and unauthorized access if users follow the example insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented backup set includes extremely sensitive personal and agent state data such as memory, identity, user profile, and custom skills, yet the warning model is weak and does not prominently require a private repository or explain the privacy consequences of remote storage. Users may unknowingly publish or broadly expose irreplaceable sensitive data if the repository is misconfigured or later made public.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-of-file comment lists "灾难恢复" as a supported function, creating the impression that restoration from backups is implemented. In reality, the restore command stops with a TODO/error after making only a local backup of the current workspace, so the documentation overstates the skill's actual behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a configuration synchronization tool with backups, .gitignore handling, and version control, but the implementation achieves this by invoking system git commands via execSync and performing remote force-push operations. Spawning subprocesses and executing shell commands is a distinct capability with broader security impact than ordinary file synchronization and is not explicitly disclosed in the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The tool transmits local workspace contents to a remote repository and force-pushes branch state without an explicit warning or confirmation, which can cause unintended exfiltration of sensitive files and overwrite remote history. In a skill context that copies memory, config, and skills content from ~/.openclaw/workspace, this is more dangerous because users may not realize personal or sensitive agent data is being published remotely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file's user-facing instructions and descriptions are presented only in Chinese, and there is no indication that this skill is intentionally region-specific or that alternative language support is available. This can constitute a natural-language policy issue when a specific language is effectively required without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language content consistently uses Chinese for the description and operational instructions, and there is no indication that users can choose another language. Under the policy provided, forcing a specific language without opt-in is a language/locale policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file's natural-language interface and instructions are entirely in Chinese, with no option for users to select another language or locale. The policy specifically calls for flagging language or locale constraints when they are forced without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

Beyond straightforward file synchronization, the code reads ~/.openclaw/.backup.env, derives an instance identity from configuration or hostname, and uses that identity in remote git branch management. This host-identification and multi-instance branch orchestration is additional behavior not reflected in the manifest description of selective backup, .gitignore support, and version control.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:129