Clawdbot Backup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

This backup skill is mostly purpose-aligned, but it asks users to copy, upload, restore, and schedule sensitive agent configuration in ways that could expose or overwrite important data.

Install only if you are comfortable reviewing what is inside ~/.claude before backing it up or syncing it. Prefer private encrypted storage, avoid git add . and unattended git push, validate archives before restoring, run rsync with dry-run before any --delete use, and do not schedule recurring jobs until you have narrowed the backup scope and confirmed no secrets will be uploaded.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:548

Finding

Persistent Scheduled Execution Through Cron, systemd, and launchd

Content

View full analysis

/dev/null ``` ```bash # Create service: ~/.config/systemd/user/clawdbot-backup.service cat > ~/.config/systemd/user/clawdbot-backup.service << 'EOF' [Unit] Description=ClawdBot Backup [Service] Type=oneshot ExecStart=/home/user/.local/bin/clawdbot-backup backup full EOF # Create timer: ~/.config/systemd/user/clawdbot-backup.timer cat > ~/.config/systemd/user/clawdbot-backup.timer << 'EOF' [Unit] Description=Daily ClawdBot Backup [Timer] OnCalendar=daily Persistent=true [Install] WantedBy=timers.target EOF # Enable systemctl --user enable clawdbot-backup.timer systemctl --user start clawdbot-backup.timer ``` ```bash # Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF' Label com.clawdbot.backup ProgramArguments /Users/username/.local/bin/clawdbot-backup backup full StartCalendarInterval Hour 2 Minute 0 EOF # Load launchctl load ~/Library/LaunchAgents/com.clawdbot.backup.plist ``` ### Technical Analysis ...[truncated 1818 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:407

Finding

Broad Git Staging and Cloud Synchronization Can Expose Sensitive Configuration

Content

View full analysis

/dev/null || echo "Push failed (offline?)" ``` ```bash # Copy settings cp ~/.claude/settings.json "$CLOUD_DIR/" ``` ```bash sync_to_cloud() { echo "Syncing to cloud..." mkdir -p "$SYNC_DIR" rsync -avz --delete "$CLAUDE_DIR/skills/" "$SYNC_DIR/skills/" rsync -avz --delete "$CLAUDE_DIR/commands/" "$SYNC_DIR/commands/" rsync -avz "$CLAUDE_DIR/mcp/" "$SYNC_DIR/mcp/" 2>/dev/null cp "$CLAUDE_DIR/settings.json" "$SYNC_DIR/" 2>/dev/null echo "Sync complete!" } ``` ```bash # Add git auto-commit every 6 hours 0 */6 * * * cd ~/.claude && git add . && git commit -m "Auto-backup $(date +\%Y-\%m-\%d)" && git push 2>/dev/null ``` ### Technical Analysis The Skill identifies `settings.json` and the entire MCP directory as backup targets and uses broad commands such as `git add .`. MCP and settings files may contain private server addresses, command arguments, environment references, access tokens, or other operational secrets. The suggested `.gitignore` only excludes selected filename patterns such as `*.pem`, `*.key`, and `credentials/`. It does not protect secrets embe ...[truncated 1631 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:470

Finding

Destructive rsync Synchronization Uses --delete Without Validation or Confirmation

Content

View full analysis

/dev/null cp "$CLAUDE_DIR/settings.json" "$SYNC_DIR/" 2>/dev/null echo "Sync complete!" } ``` ### Technical Analysis The `--delete` option removes destination files that are not present at the source. This makes synchronization destructive rather than merely additive. The examples do not: - Perform a dry run - Validate that the intended source is populated - Confirm synchronization direction - Display pending deletions - Create a destination snapshot - Require approval before deletion The same command pattern is shown in both directions. A direction mistake, empty source, path typo, unavailable mount, or stale/compromised remote can therefore remove valid configuration. ### Attack Path 1. The user selects the wrong synchronization direction, references an incomplete source, or connects to a stale or attacker-modified remote. 2. `rsync` computes differences between that source and the destination. 3. Because `--delete` is enabled, files present only at the destination are deleted. 4. Remaining files may also be overwritten by stale or malicious source content. 5. The Agent loses valid Skills and configuration or begins using attacker-controlled synchronized content. ### Impact Assessment The affected scope includes the destination under `~/.claude` or the remote backup direct ...[truncated 325 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:114

Finding

Archives Are Extracted Directly Into Trusted Directories Without Path Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

ESSENTIAL (Always backup):
✓ ~/.claude/skills/           # Custom skills
✓ ~/.claude/commands/         # Custom commands
✓ ~/.claude/settings.json     # Global settings
✓ ~/.claude/mcp/              # MCP configurations

RECOMMENDED (Usually backup):

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

✓ Project .claude/ folders # Project configs

OPTIONAL (Case by case): ○ ~/.claude/settings.local.json # Machine-specific ○ Cache directories # Can be rebuilt ○ Log files # Usually not needed

text

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md

exit 1
    fi
    
    log_warn "This will overwrite existing configuration!"
    read -p "Continue? (y/N) " confirm
    
    if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 81% confidence

Finding

The cleanup pipeline uses ls | tail | xargs rm to delete backup archives, which is brittle and can behave unsafely with unusual filenames or shell edge cases. In a backup-management tool, deletion logic deserves extra care because mistakes can remove the wrong files or all retained backups.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md

if [ "$count" -gt "$MAX_BACKUPS" ]; then
        local to_delete=$((count - MAX_BACKUPS))
        ls -1t *.tar.gz | tail -n "$to_delete" | xargs rm -v
        log_info "Removed $to_delete old backup(s)"
    else
        log_info "No cleanup needed ($count backups)"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

find "$CLAUDE_DIR/skills" -name "SKILL.md" 2>/dev/null | wc -l | xargs echo "Skills:"

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

This instruction copies ~/.claude/settings.json into a cloud-synced folder, moving potentially sensitive configuration off the local machine. In the context of a backup/sync skill, this is functional behavior, but it becomes risky because the guide does not clearly warn about secret-bearing settings or recommend filtering sensitive content.

Content

Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

rsync -avz ~/.claude/commands/ "$CLOUD_DIR/commands/"

Copy settings

cp ~/.claude/settings.json "$CLOUD_DIR/"

text

### Sync Script

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 386)May include surrounding context.

md

# Initialize git
git init

# Create .gitignore
cat > .gitignore << 'EOF'
# Machine-specific settings
settings.local.json

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends committing and pushing the entire ~/.claude directory to a remote repository, but that directory may contain sensitive configuration, MCP server definitions, tokens, prompts, or other secrets. Without strong warnings and a restrictive allowlist, users may accidentally publish private data to GitHub or another remote host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rsync/cloud sync instructions copy ClawdBot configuration, commands, skills, and MCP-related data off-machine without a privacy warning. This can expose sensitive local settings or service configuration to third-party cloud folders or remote servers, especially when users assume all copied data is harmless.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 488)May include surrounding context.

md

# Backup to cloud folder (Dropbox, Google Drive, etc)
CLOUD_DIR="$HOME/Dropbox/ClawdBot"

# Sync skills
rsync -avz ~/.claude/skills/ "$CLOUD_DIR/skills/"
rsync -avz ~/.claude/commands/ "$CLOUD_DIR/commands/"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 549)May include surrounding context.

bash

# Edit crontab
crontab -e

# Add daily backup at 2 AM
0 2 * * * /home/user/.local/bin/clawdbot-backup backup full

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 564)May include surrounding context.

Systemd Timer (Linux)

bash

# Create service: ~/.config/systemd/user/clawdbot-backup.service
cat > ~/.config/systemd/user/clawdbot-backup.service << 'EOF'
[Unit]
Description=ClawdBot Backup

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 588)May include surrounding context.

EOF

Enable

systemctl --user enable clawdbot-backup.timer systemctl --user start clawdbot-backup.timer

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 595)May include surrounding context.

Launchd (macOS)

bash

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 596)May include surrounding context.

Launchd (macOS)

bash

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 598)May include surrounding context.

Launchd (macOS)

bash

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 599)May include surrounding context.

Launchd (macOS)

bash

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 617)May include surrounding context.

Launchd (macOS)

bash

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 621)May include surrounding context.

Launchd (macOS)

bash

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 598)May include surrounding context.

md

# Create plist: ~/Library/LaunchAgents/com.clawdbot.backup.plist
cat > ~/Library/LaunchAgents/com.clawdbot.backup.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 621)May include surrounding context.

EOF

Load

launchctl load ~/Library/LaunchAgents/com.clawdbot.backup.plist

text

## Migration Guide

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

git clone [e-mail]:username/clawdbot-config.git ~/.claude

3. Verify

ls -la ~/.claude/skills/

text

### Export Single Skill

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

git clone [e-mail]:username/clawdbot-config.git ~/.claude

3. Verify

ls -la ~/.claude/skills/

text

### Export Single Skill

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 689)May include surrounding context.

tar -tzvf backup.tar.gz

Verify specific file exists

tar -tzvf backup.tar.gz | grep "skills/my-skill/SKILL.md"

text

### Compare Backup to Current

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 700)May include surrounding context.

md

tar -xzf backup.tar.gz -C "$TEMP_DIR"

# Compare
diff -rq ~/.claude/skills "$TEMP_DIR/.claude/skills"

# Cleanup
rm -rf "$TEMP_DIR"

Static analysis

No suspicious patterns detected.