Security audit
Security checks for vulnerabilities and agentic risk
This backup skill is mostly purpose-aligned, but it needs review because it handles sensitive accounting data with broad background access and inconsistent encryption-key guidance.
Install only for a Greek accounting deployment where broad local access to client data is intended. Before use, require a single documented encryption-key model, restrict permissions on backup/auth/log paths, define who or what may trigger event snapshots, and review permanent logs for sensitive content. There is no artifact evidence of exfiltration or destructive hidden behavior, but the current documentation leaves enough high-impact operational ambiguity to warrant review.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
export OPENCLAW_DATA_DIR="/data"
export OPENCLAW_ENCRYPTION_KEY="your-256-bit-key" # Never store on disk
which jq openssl tar || sudo apt install jq openssl tar
mkdir -p $OPENCLAW_DATA_DIR/backups
The prompt states that a government submission 'was just completed' and that a snapshot 'should be triggered,' but it does not define any authorization, source-of-truth event signal, or validation boundary for who can cause that action. In a backup skill that writes encrypted snapshots with indefinite retention into /data/backups/, an ambiguous trigger can allow unintended or unauthorized snapshot creation, producing storage abuse, sensitive data over-collection, or audit noise.
The eval hard-codes Greek legal retention rules and expects the skill to apply them automatically without documenting jurisdictional scope, tenant applicability, or a way for the user/operator to select or override policy. In a data retention context, enforcing the wrong legal regime can lead to unlawful retention or premature deletion recommendations, creating compliance, privacy, and evidentiary risks across clients outside the intended scope.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
export OPENCLAW_DATA_DIR="/data"
export OPENCLAW_ENCRYPTION_KEY="your-256-bit-key" # Never store on disk
which jq openssl tar || sudo apt install jq openssl tar
mkdir -p $OPENCLAW_DATA_DIR/backups
The skill states in setup metadata that the backup encryption key is never stored on disk, but later documents backup encryption as using a key stored at /data/auth/backup-key.enc. This contradiction can cause unsafe implementations, operator confusion, and accidental persistence of a highly sensitive secret, undermining backup confidentiality.
The backup key handling guidance is inconsistent and lacks a precise warning about secret exposure, making insecure deployments more likely. Ambiguous secret-handling instructions around encryption keys can result in keys being written to disk, committed to configs, or exposed via weak file permissions, defeating the purpose of encrypted backups.
The skill broadly states that records are not auto-deleted and require explicit human approval, but the retention schedule also declares automatic purging of processing and memory files after 90 days. This policy inconsistency can lead operators to assume human approval exists for all deletions when some data is actually deleted automatically, creating data loss and compliance risk.
The skill mandates persistent logging of episodes and failures and says certain system-operation logs bypass rate limits, which increases the chance that sensitive operational details, identifiers, or client-related context are retained indefinitely. Over-retention of natural-language or diagnostic content can expand the blast radius of any later compromise and create privacy/compliance issues.
The scheduling instructions hard-code operation times in Athens time, which is a locale-specific constraint expressed in natural language. While the skill is Greek-focused, the file does not explicitly present this as a user-selectable or clearly justified locale policy at the scheduling points where the restriction is imposed.
No suspicious patterns detected.