Security audit
Security checks for vulnerabilities and agentic risk
This is a plausible OpenClaw backup and restore skill, but its restore script can extract an arbitrary archive into the user's home directory and the backup contains sensitive data without strong protection guidance.
Review before installing. Only restore archives you created and trust, because a crafted backup could overwrite files in your home directory. Treat created backups as sensitive secrets: they may contain chat history, memory, identity data, configuration, and credential files, and should be stored on encrypted, access-controlled media rather than shared or untrusted cloud locations.
scripts/restore.sh:56Unrestricted Backup Archive Extraction into the User Home Directory
scripts/backup.sh:24Predictable Shared Temporary File Permits Manifest Manipulation
scripts/backup.sh:24Sensitive OpenClaw Data Is Stored in an Unencrypted Backup Archive
The code clearly implements local backup of OpenClaw data and supports two backup modes: default exclusion of the skills directory and optional inclusion via INCLUDE_SKILLS=1, which aligns with the quick/full backup description. It writes the archive to the desktop by default or to a user-supplied path, also consistent with the description. However, there is no logic for scheduling, cron setup, timers, or automatic recurring execution in this code chunk. Since 'supports scheduled automatic backups' is part of the declared description but not represented in the supplied code, this is a description-behavior mismatch.
The declared description says this skill performs backups of OpenClaw data, including quick/full backup modes and scheduled automatic backups. The supplied code does not create backups at all. Its primary purpose is the opposite: restoring from an existing backup archive. It validates an input backup file, warns about missing OpenClaw installation, prompts before replacing existing ~/.openclaw data, moves current data to a timestamped backup directory, extracts the archive into the home directory, and optionally syncs skills. This is a material description-behavior mismatch because the code's core function is restore, not backup, and it also lacks any scheduling functionality described in the declaration.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
tar -czf "$BACKUP_FILE" -T /tmp/openclaw-backup-list.txt
# 清理临时文件
rm -f /tmp/openclaw-backup-list.txt
# 显示结果
ACTUAL_SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
The README explicitly states that backups include highly sensitive material such as conversation history, memory data, configuration, and encrypted credentials, but the operational backup/restore instructions do not prominently warn users that they are creating and transferring a sensitive archive. In a backup/migration skill, this omission increases the chance users will store the archive on insecure media or share it through untrusted channels, leading to confidentiality loss.
The restore workflow describes automatic installation, extraction, and startup behavior without an explicit caution that running the restore script will modify the local system and may overwrite or replace existing OpenClaw data. Because this is presented as a simple one-click action, users may execute it without understanding the extent of system changes, increasing the risk of accidental overwrite, unwanted software installation, or restoration from an untrusted archive.
The skill explicitly states that backups include sensitive material such as conversation history, memory, configuration, and encrypted credentials, but it does not prominently warn users that the resulting archive is security-sensitive. Users may store, transfer, or share the archive insecurely, leading to disclosure of private data or credential material if the archive is accessed by others.
The manifest describes a quick backup as 'without skills' and positions it as a smaller desktop backup, but the implemented file list still includes sensitive and broad OpenClaw state such as .openclaw/credentials, .openclaw/identity, and other operational data. This is more than a minimal lightweight cache-style backup and materially expands what the skill preserves beyond the manifest's simplified framing.
The backup list explicitly includes .openclaw/credentials, causing secrets to be written into a tar.gz archive without any warning, access control guidance, or optional exclusion. In a desktop-backup workflow, users may move or store the archive insecurely, increasing the risk of credential disclosure if the file is copied, synced, or accessed by another user.
The skill is described as a backup utility, but it also includes full restore behavior that overwrites user state under ~/.openclaw and extracts an arbitrary archive into the user's home directory. This mismatch increases the chance that users invoke destructive functionality without expecting it, and the restore flow lacks archive-content validation, making it risky if a malicious or tampered backup file is supplied.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
### Ease of Use / 易用性
**English:**
- **No technical knowledge required** - Double-click scripts handle everything
- **Automatic detection** - Detects existing data and preserves it
- **Smart installation** - Installs OpenClaw automatically if missing
- **Cross-platform** - Same backup works on macOS, Linux, and Windows
All user-facing comments and echo output are in Chinese, with no option to select another language and no documentation that the skill is intentionally limited to a Chinese-speaking audience. This is a natural-language policy concern because it imposes a locale/language choice without opt-in.
Beyond handling backup archives, the script checks for an OpenClaw installation and advises global npm installation, then later runs clawhub sync after restore. Those operational capabilities relate to environment setup and remote/local skill synchronization rather than the manifest's narrowly stated backup purpose.
No suspicious patterns detected.