Security audit

Backup & Restore

Security checks for vulnerabilities and agentic risk

Overview

This is a real backup and restore skill, but its scripts can expose OpenClaw credentials through unsafe plaintext backup and restore handling, so it needs review before use.

Install only if you are comfortable with a backup tool that can read all OpenClaw data, store reusable secrets, schedule recurring jobs, and upload archives to configured cloud services. Before using it, keep encryption enabled, avoid portable/unencrypted full backups, protect all credential files with strict permissions, use least-privilege cloud identities, and restore only archives you trust.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup.sh:35
Finding: Portable mode is ignored, allowing credentials to be included in plaintext backups
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup.sh:60
Finding: Complete plaintext archives are written to persistent storage before encryption
Content: View full analysis
/dev/null || echo unknown)" ``` ```bash FULL_NAME="openclaw-${HOSTNAME_SHORT}-${TIMESTAMP}-full.tar.gz" FULL_PATH="$BACKUP_DIR/$FULL_NAME" log "Creating full backup..." tar czf "$FULL_PATH" -C "$HOME" .openclaw/ log "Full archive: $FULL_PATH ($(du -h "$FULL_PATH" | cut -f1))" if [[ "$ENCRYPT" == "true" ]]; then log "Encrypting full backup with AES-256..." gpg --batch --yes --symmetric --cipher-algo AES256 \ --passphrase "$PASSPHRASE" \ --output "${FULL_PATH}.gpg" \ "$FULL_PATH" rm -f "$FULL_PATH" ``` ```bash WS_NAME="openclaw-${HOSTNAME_SHORT}-${TIMESTAMP}-workspace.tar.gz" WS_PATH="$BACKUP_DIR/$WS_NAME" log "Creating workspace-only backup..." tar czf "$WS_PATH" -C "$HOME" .openclaw/workspace/ log "Workspace archive: $WS_PATH ($(du -h "$WS_PATH" | cut -f1))" if [[ "$ENCRYPT" == "true" ]]; then log "Encrypting workspace backup..." gpg --batch --yes --symmetric --cipher-algo AES256 \ --passphrase "$PASSPHRASE" \ --output "${WS_PATH}.gpg" \ "$WS_PATH" rm -f "$WS_PATH" ``` ### Technical Analysis The script first creates complete unencrypted archives in the persistent backup directory and only then encrypts and removes them. It does not set a restrictive `umask`, explicitly set file permissions, or register cleanup for partially created plaintext archives. If GPG fails, the process is interrupted, storage becomes full, or the machine crashes between archive creation and deletion, the plaintext archive remains on disk. Even after deletion, data may remain re ...[truncated 951 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backup.sh:99
Finding: Backup encryption passphrase is exposed through process command-line arguments
Content: View full analysis
/dev/null gpg --batch --yes --decrypt \ --passphrase "$PASSPHRASE" \ --output "$TEST_FILE.dec" \ "$TEST_FILE.gpg" 2>/dev/null ``` ### Technical Analysis Passing a secret with `--passphrase "$PASSPHRASE"` places the passphrase in GPG's argument vector. Depending on operating-system process visibility and `/proc` restrictions, another local process may be able to inspect the command line while GPG is running. The same passphrase protects both full and workspace backups, so disclosure compromises all archives encrypted with that passphrase. ### Attack Path 1. A local attacker continuously monitors process command lines. 2. The user runs backup, restore, or the setup test. 3. GPG starts with the passphrase in its argument vector. 4. The attacker records the passphrase. 5. The attacker uses it to decrypt any accessible current or historical backup protected by the same secret. ### Impact Assessment The immediate privilege gained is the ability to decrypt accessible OpenClaw backups. Full backups may disclose credentials that grant broader access to APIs, cloud accounts, storage buckets, and other configured services. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/restore.sh:174
Finding: Full restore extracts unvalidated archives directly into the user's home directory
Content: View full analysis
/dev/null || true fi gsutil cp "$SOURCE" "$LOCAL_FILE" elif [[ -f "$SOURCE" ]]; then LOCAL_FILE="$SOURCE" else die "Source not found or unsupported: $SOURCE" fi ``` ```bash else # Full restore: replace entire ~/.openclaw/ if [[ -d "$OPENCLAW_DIR" ]]; then SAFETY="$HOME/.openclaw.pre-restore" [[ -d "$SAFETY" ]] && rm -rf "$SAFETY" log "Moving existing ~/.openclaw/ → ~/.openclaw.pre-restore/" mv "$OPENCLAW_DIR" "$SAFETY" fi log "Extracting full backup..." tar xzf "$ARCHIVE" -C "$HOME" log "Full restore complete" fi ``` ### Technical Analysis The restore process accepts local archives and objects downloaded from cloud storage, then extracts full backups directly into `$HOME`. Before extraction, it does not validate: - That every member is under `.openclaw/` - Absolute or parent-directory traversal paths - Symbolic or hard links - Device files or unexpected file types - Ownership and permission metadata - Archive authenticity or cryptographic integrity beyond successful symmetric decryption A crafted archive can therefore attempt to write unexpected files under the user's home directory. Even if the installed `tar` implementation blocks common traversal forms, unrestricted members that legitimately name files such as `.bashrc`, `.profile`, or applicatio ...[truncated 971 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/setup-guide.md:97
Finding: Cloud credential files lack consistent permission and ownership enforcement
Content: View full analysis
-credentials` 4. Add the destination entry to `config.json` 5. Run `test-backup.sh` to verify connectivity ``` Provider credentials are stored as follows: ```bash export AWS_ACCESS_KEY_ID="AKIA..." export AWS_SECRET_ACCESS_KEY="..." ``` ```bash export AWS_ACCESS_KEY_ID="your-r2-access-key" export AWS_SECRET_ACCESS_KEY="your-r2-secret-key" ``` ```bash export B2_APPLICATION_KEY_ID="your-key-id" export B2_APPLICATION_KEY="your-key" ``` The documentation also directs users to store a GCS service-account key and an OAuth-bearing rclone configuration in the same directory: ```text Save it to `~/.openclaw/credentials/backup/gcs-key.json` ``` ```text Copy the generated config to `~/.openclaw/credentials/backup/rclone.conf` ``` ### Technical Analysis The setup guide explicitly requires mode 600 for the backup passphrase, but no equivalent requirement is stated or enforced for AWS, R2, B2, GCS, or rclone credentials. The scripts merely check whether these files exist and then read them or pass them to external clients. If files are created under a permissive umask, other local users may be able to read long-lived access keys, service-account material, or OAuth refresh tokens. There is also no script-side validation of file ownership, symbolic links, or group/world permissions. ### Attack Path 1. A user follows the setup instructions and creates a provider credential file. 2. The file inherits permissive ambient permissions. 3. Another local user reads ...[truncated 503 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/destinations.md:3
Finding: Setup instructions install mutable third-party packages without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is clearly a local backup script, not a full implementation of the broader declared description. It does support encrypted backups of ~/.openclaw and creates a workspace-only archive, which aligns with part of the description. However, the declared purpose explicitly includes restore, disaster recovery, migration, and storing backups to multiple cloud destinations, none of which are implemented in this supplied chunk. The gateway stop/start behavior is a reasonable supporting detail, not a mismatch. The main discrepancy is that the actual code only performs local backup creation and retention management, so the description overstates the capabilities of this code chunk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
./scripts/restore.sh openclaw-myhost-20260215-full.tar.gz.gpg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
./scripts/restore.sh openclaw-myhost-20260215-full.tar.gz.gpg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
./scripts/restore.sh openclaw-myhost-20260215-full.tar.gz.gpg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
./scripts/restore.sh openclaw-myhost-20260215-full.tar.gz.gpg

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/restore.sh (reported line 155)May include surrounding context.
sh
if [[ -d "$WORKSPACE_DIR" ]]; then SAFETY="${WORKSPACE_DIR}.pre-restore" [[ -d "$SAFETY" ]] && rm -rf "$SAFETY" log "Moving existing workspace → ${SAFETY}/" mv "$WORKSPACE_DIR" "$SAFETY" fi

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/restore.sh (reported line 176)May include surrounding context.
sh
if [[ -d "$WORKSPACE_DIR" ]]; then SAFETY="${WORKSPACE_DIR}.pre-restore" [[ -d "$SAFETY" ]] && rm -rf "$SAFETY" log "Moving existing workspace → ${SAFETY}/" mv "$WORKSPACE_DIR" "$SAFETY" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/restore.sh (reported line 206)May include surrounding context.
sh
echo " 1. Review the restored files at ~/.openclaw/" echo " 2. Start the gateway: openclaw gateway start" echo " 3. If everything works, remove the safety copy:" echo " rm -rf ~/.openclaw.pre-restore/" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/restore.sh (reported line 206)May include surrounding context.
sh
echo " 1. Review the restored files at ~/.openclaw/" echo " 2. Start the gateway: openclaw gateway start" echo " 3. If everything works, remove the safety copy:" echo " rm -rf ~/.openclaw.pre-restore/" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The delete target is built from configuration-controlled bucket/path data and passed directly to aws s3 rm. If the configured bucket value includes an unexpected prefix/path, the cleanup step could delete an unintended remote object rather than only the just-uploaded test artifact.
Content: Scanner excerpt · scripts/test-backup.sh (reported line 135)May include surrounding context.
sh
safe_load_creds "$CRED_DIR/aws-credentials" || true if aws s3 cp "$TEST_UPLOAD" "${BUCKET%/}/$TEST_NAME" --region "$REGION" 2>&1 && \ aws s3 rm "${BUCKET%/}/$TEST_NAME" --region "$REGION" 2>&1; then pass "S3 upload + cleanup OK" else fail "S3 upload failed"; ((FAILURES++))

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The R2 cleanup command constructs the deletion URI from configuration-controlled bucket data without enforcing that the field is bucket-only. A malformed or overbroad configured value could cause deletion of an unintended object in remote storage during cleanup.
Content: Scanner excerpt · scripts/test-backup.sh (reported line 148)May include surrounding context.
sh
safe_load_creds "$CRED_DIR/r2-credentials" || true if aws s3 cp "$TEST_UPLOAD" "s3://${BUCKET}/$TEST_NAME" --endpoint-url "$ENDPOINT" 2>&1 && \ aws s3 rm "s3://${BUCKET}/$TEST_NAME" --endpoint-url "$ENDPOINT" 2>&1; then pass "R2 upload + cleanup OK" else fail "R2 upload failed"; ((FAILURES++))

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The GCS removal path is derived from the configured bucket string with only minimal trimming, so a bucket value containing additional path elements could broaden what object is targeted for deletion. In a backup tool that talks to real cloud storage, this increases the chance of accidental destructive operations against remote data.
Content: Scanner excerpt · scripts/test-backup.sh (reported line 173)May include surrounding context.
sh
gcloud auth activate-service-account --key-file="$CRED_DIR/gcs-key.json" 2>/dev/null || true if gsutil cp "$TEST_UPLOAD" "${BUCKET%/}/$TEST_NAME" 2>&1 && \ gsutil rm "${BUCKET%/}/$TEST_NAME" 2>&1; then pass "GCS upload + cleanup OK" else fail "GCS upload failed"; ((FAILURES++))

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
## Manual Usage ### backup.sh — Create local backups Every run produces **two files**:

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The documentation is internally inconsistent about whether workspace backups are always encrypted: several sections say workspace backups are encrypted, while examples and filename conventions show plain .tar.gz restores. That ambiguity can lead operators to create, transfer, or restore unencrypted archives containing memory, notes, conversations, and other sensitive data, causing accidental disclosure.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/destinations.md (reported line 8)May include surrounding context.
CLI needed: aws (AWS CLI)

bash
pip install awscli # or: sudo apt install awscli

Setup:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/destinations.md (reported line 79)May include surrounding context.
CLI needed: aws (AWS CLI)

bash
pip install awscli # or: sudo apt install awscli

Setup:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/destinations.md (reported line 101)May include surrounding context.
CLI needed: aws (AWS CLI)

bash
pip install awscli # or: sudo apt install awscli

Setup:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/destinations.md (reported line 12)May include surrounding context.
text
**Setup:** 1. Create an S3 bucket in your AWS account 2. Create an IAM user with S3 write access (or use an existing one) 3. Save credentials to `~/.openclaw/credentials/backup/aws-credentials`: ```bash

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell users to place long-lived AWS credentials in a file under ~/.openclaw without any warning about file permissions, rotation, or the sensitivity of the secret material. In a backup skill, these credentials are especially valuable because they can grant persistent access to backup storage and may expose or enable tampering with protected data if the local machine or config directory is later compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A downloaded GCS service account JSON key is a reusable bearer secret, and the instructions omit any warning that storing it locally creates a high-value target. In backup/restore context this is more dangerous because the key may allow broad object access to backup archives, enabling data theft or unauthorized modification depending on the account scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: rclone.conf can contain reusable OAuth refresh tokens and remote definitions, but the instructions present copying it into ~/.openclaw as routine without warning about token sensitivity. In a backup destination skill, compromise of that config could grant ongoing access to cloud-stored backups and facilitate exfiltration of potentially sensitive archives.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/destinations.md (reported line 120)May include surrounding context.
md
## Remote Retention & Lifecycle Local backups are auto-pruned after 30 days (configurable). **Remote backups are never automatically deleted** — this is intentional. Storage is cheap, and offsite backups should be your safety net. To manage remote retention, set lifecycle rules directly on your storage provider:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly instructs storing a backup encryption passphrase and provider credentials on disk under ~/.openclaw/credentials/backup, but it does not clearly warn the user that this creates a local secret-at-rest risk. In the context of a backup skill handling API keys and recovery secrets, compromised local access, malware, or overly broad filesystem permissions could expose both backup contents and cloud destinations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guide recommends cron-based unattended backups and optional chained cloud uploads, but does not clearly disclose that this will repeatedly collect local data and may automatically transmit it to third-party services. In a backup skill covering workspace contents and possibly credentials, lack of prominent consent and scope warning increases the risk of unintended ongoing data exfiltration or privacy exposure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: This script intentionally archives the entire ~/.openclaw directory, which likely includes credentials, tokens, and session material, then stores the backup on disk. While backup is the skill's stated purpose, persisting full application state materially increases exposure if the backup directory is accessed by another local user, synced insecurely, or encryption is disabled or mismanaged.
Content: Scanner excerpt · scripts/backup.sh (reported line 2)May include surrounding context.
sh
#!/usr/bin/env bash # backup.sh — Create local backups of ~/.openclaw/ # Always produces two files: # 1. Full backup (encrypted) — everything, for disaster recovery on same/similar environment # 2. Workspace-only backup — just the workspace (memory, skills, files), safe for any environment