Keep My Claw — OpenClaw Backup

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

A user could be moved through a paid backup setup and credential-handling workflow before reviewing the exact data scope and privileges.

Why it was flagged

The default flow minimizes human involvement while creating an account, obtaining a paid checkout link, creating keys, running a first backup, and scheduling future backups.

Skill content

**You (the agent) handle everything. The human only clicks a payment link.**

Recommendation

Require explicit user confirmation before account creation, payment checkout, first backup, and scheduling; show the data scope before upload.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If the local config or agent is compromised, the attacker may get broader Keep My Claw account authority than needed for backup and restore.

Why it was flagged

The default setup creates an admin API key for the agent, even though the same documentation later describes an agent-scoped key for backup/restore only.

Skill content

-d '{"name":"agent","permissions":"admin"}'

Recommendation

Default to the least-privileged agent key, and require a separate user-approved admin action only when account management is actually needed.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

This is expected for full-agent backup, but it means auth tokens and other credentials are part of the off-site snapshot.

Why it was flagged

The backup script includes every file under the OpenClaw credentials directory in the encrypted archive and uploads it to the Keep My Claw API.

Skill content

find credentials -type f ... --data-binary @"$ENC_FILE" ... "/v1/agents/${CLAWKEEPER_AGENT_NAME}/backups"

Recommendation

Use this only if you trust the service and encryption model; inspect the file list and consider exclusions for credentials you do not want backed up.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

An agent-run restore could overwrite workspace files, credentials, cron jobs, and agent configuration without a fresh human confirmation.

Why it was flagged

When restore runs without an interactive terminal, it proceeds after the overwrite warning and extracts files into ~/.openclaw.

Skill content

echo "  (Non-interactive mode — proceeding)" ... tar -xzf "$TAR_FILE" -C "$OPENCLAW_DIR"

Recommendation

Require an explicit --yes flag or human approval for restore, create a pre-restore backup, and review restored cron jobs and credentials before restart.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

A malicious or malformed value could cause shell commands to run later when backup, restore, list, or prune scripts load the config.

Why it was flagged

Raw API key, agent name, and URL values are written into a shell config file; the other scripts source that file, so quotes or newlines in those values could become shell syntax.

Skill content

cat > "$CONFIG_FILE" <<EOF ... CLAWKEEPER_API_KEY="${api_key}" ... CLAWKEEPER_API_URL="${api_url}"

Recommendation

Store config as JSON or another non-executable format, or strictly validate and shell-escape every value before writing a sourced file.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Sensitive or poisoned agent state can be preserved and reintroduced on another machine during restore.

Why it was flagged

The skill intentionally captures and restores persistent agent context, skills, and scheduled jobs.

Skill content

backs up your entire agent system — workspace, memory, skills, projects, cron jobs, credentials, and multi-agent configs

Recommendation

Review snapshots before restore where possible, keep the encryption passphrase secure, and consider allowlists or exclusions for sensitive memory, skills, and scheduled tasks.

Findings (2)

critical

suspicious.exposed_secret_literal

Location: SKILL.md:130
Finding: File appears to expose a hardcoded API secret or token.

critical

suspicious.generated_source_template_injection

Location: SKILL.md:85
Finding: User-controlled placeholder is embedded directly into generated source code.