Booker's OpenClaw Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw backup tool, but its restore flow can direct users to run code from a backup bundle and its archives may expose sensitive state through loose local permissions.

Install only if you understand that backup bundles should be treated like credentials. Store them in a private directory, restore only bundles you created and trust, and avoid running restore.sh from a bundle received through shared or untrusted storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create_backup.sh:112

Finding

Sensitive backup archives may be created with overly permissive filesystem permissions

Content

View full analysis

/dev/null)" ]]; then BACKUP_PATH="${PARENT_DIR}/pre-restore-backup-${TIMESTAMP}.tar.gz" tar -C "$PARENT_DIR" -czf "$BACKUP_PATH" "$TARGET_NAME" safe_create_checksum "$BACKUP_PATH" "${BACKUP_PATH}.sha256" printf 'Created pre-restore backup: %s\n' "$BACKUP_PATH" fi ``` ### Technical Analysis The scripts archive the complete OpenClaw state, which may include credentials, access tokens, private configuration, conversation data, and other sensitive files. However, the scripts neither set a restrictive process `umask` nor explicitly apply secure permissions to the output directory, completed archives, temporary archives, pre-restore archives, or checksum files. File permissions therefore depend on the invoking process's environment. Under a common `umask` of `022`, newly created archives are normally readable by all local users, such as mode `0644`, while newly created directories may use mode `0755`. Although the staging directory produced by `mktemp -d` is normally private, the final archive is moved into the configured output directory and retains the permissions assigned when the temporary archive was created. The same issue affects pre-restore archives created next to the restore target. ### Attack Path 1. A user runs `scripts/create_backup.sh` with a permissive `umask`, such as `022`. 2. The script packages the entire OpenClaw state into ...[truncated 994 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/select_and_restore.sh:167

Finding

Unauthenticated backup bundles can provide an attacker-controlled restore script

Content

View full analysis

&2; exit 1; } ;; .openclaw) [[ "$type" == d ]] || { echo "Bundled .openclaw root must be a directory: $path" >&2; exit 1; } ;; .openclaw/*) [[ "$type" == d || "$type" == - ]] || { echo "Bundled .openclaw contains unsupported entry type: $path" >&2; exit 1; } ;; ``` The accepted archive is then extracted: ```bash selected="${bundles[$index]}" audit_bundle_archive "$selected" "$PREFIX" extract_dir="$(mktemp -d /tmp/openclaw-restore-bundle.XXXXXX)" tar -C "$extract_dir" -xzf "$selected" ``` The user is instructed to execute the archive-supplied script: ```bash printf 'Extracted to: %s\n' "$bundle_root" printf 'Run this to restore:\n' printf 'bash %q/%s\n' "$bundle_root" "$RESTORE_SCRIPT_NAME" ``` The generated script verifies checksums from a file stored in the same unauthenticated archive: ```bash if grep -Evq '^[0-9a-f]{64} [^[:space:]].*$' "$SCRIPT_DIR/$PACKAGE_CHECKSUM_NAME"; then echo "Checksum file contains malformed entries" >&2 exit 1 fi (cd "$SCRIPT_DIR" && sha256sum -c "$PACKAGE_CHECKSUM_NAME") ``` ### Technical Analysis The archive validation rejects symbolic links, hard links, special files, unexpected paths, and multiple top-level roots. These controls reduce archive extraction attacks, but they do not establish the authenticity of executable content. An attacker can create a syntactically valid bundle containing: - A malicious regular file named ...[truncated 2313 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

bash scripts/select_and_restore.sh

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/create_backup.sh (reported line 388)May include surrounding context.

sh

mapfile -t archives < <(find "$OUT_DIR" -maxdepth 1 -type f -name "${PREFIX}-*.tar.gz" -printf '%f\n' | sort -r)
if (( ${#archives[@]} > KEEP_COUNT )); then
  for old_archive in "${archives[@]:KEEP_COUNT}"; do
    rm -f "$OUT_DIR/$old_archive"
  done
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes shell-based operational commands but does not declare any explicit tool scope or permission boundary in the skill metadata. That creates ambiguity about what execution capabilities the agent may use and weakens least-privilege controls, which is especially relevant here because the documented workflow includes backup creation, configuration changes, extraction, and restore actions that can modify filesystem state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.