Security audit

git-backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill has a coherent purpose, but it can upload sensitive OpenClaw memory and skills to Gitee and handles access tokens and deletion paths too unsafely for automatic approval.

Review this skill before installing. Use it only if you intend to send the listed OpenClaw workspace data to a Git host, keep the repository private, use the narrowest possible short-lived token, avoid cron entries or Git remotes containing the token, and do not enable the watcher until path validation, secret scanning, and an explicit pre-push review are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup-to-gitee.sh:55
Finding: Personal access token exposed through command-line URLs and persistent Git configuration
Content: View full analysis
/dev/null || { # If clone fails, repo might not exist - initialize new mkdir -p "$BACKUP_DIR" cd "$BACKUP_DIR" git init git remote add origin "$AUTH_REPO" } fi ``` ### Technical Analysis The setup script places the Gitee personal access token in an HTTP query string. Although HTTPS protects the request in transit, the complete URL may be visible in process arguments and can be retained by local diagnostics, proxies, or request logging systems. The backup script embeds the token directly into the Git remote URL. When the repository is cloned or the remote is added, that authenticated URL is normally written to `.git/config`. The token therefore remains in plaintext within the backup checkout after the command finishes. A repository-management token is more sensitive than the minimum credential material that should be retained by a backup process. Its persistence in a Git configuration file increases the duration and scope of exposure. ### Attack Path 1. A user exports a valid `GITEE_TOKEN` and runs the setup or backup script. 2. The token appears in a `curl` or `git` command-line URL. 3. During repository initialization, the tokenized URL is stored as the `origin` remote in `$BACKUP_DIR/.git/config`. 4. A local atta ...[truncated 685 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup-to-gitee.sh:10
Finding: Externally controlled backup path is recursively deleted without safety validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup-to-gitee.sh:26
Finding: Recursive backup scope can upload undiscovered secrets and sensitive workspace data
Content: View full analysis
"$BACKUP_DIR/.gitignore" << 'EOF' # Secrets and sensitive files .env *.key *.pem *_token* *_secret* .secrets/ # Node modules node_modules/ # Temporary files *.tmp *.log *.bak EOF ``` ```bash # Stage and commit git add -A git commit -m "$COMMIT_MSG" # Push git push -u origin main 2>/dev/null || git push -u origin master 2>/dev/null || { echo "Push failed, trying force..." git push -f origin main 2>/dev/null || git push -f origin master } ``` ### Technical Analysis The script recursively copies the complete `memory/` and `skills/` directory trees, stages all resulting changes with `git add -A`, and pushes them to a remote repository. The generated `.gitignore` excludes only a small set of filename patterns. Secrets can exist under filenames not covered by those patterns, including JSON configuration files, service credentials, cookies, database exports, SSH configuration, Skill-specific authentication files, or sensitive memory records. `.gitignore` also does not automatically remove a file that is already tracked. The behavior conflicts with the Skill documentation's assurance that keys and secrets are not backed up. A private repository reduces public exposure but does not eliminate disclosure to repository collaborators, compromised accounts, integrations, logs, mirrors, or future visibility changes. ### Attack Path 1. A credential or sensitive record is cre ...[truncated 1036 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup-gitee.sh:100
Finding: Setup instructions recommend storing a personal access token in plaintext cron configuration
Content: View full analysis
> /tmp/backup.log 2>&1" echo "" echo "Or set GITEE_TOKEN in your environment for persistent use." ``` ### Technical Analysis The setup script does not itself modify the crontab or install a service. The persistence warning from the pre-scan is therefore not evidence of an automatically installed persistence mechanism. However, the displayed example instructs the user to place `GITEE_TOKEN` directly into a persistent crontab entry. This stores a reusable personal access token in plaintext and may expose it to administrative tools, backups, troubleshooting output, or other users with permission to inspect the account's scheduled tasks. The alternative recommendation to persist the token in a general environment configuration has similar risks if storage protections are not specified. Automatic scheduling is reasonable for the declared backup feature, but persistent plaintext token storage is not the minimum-risk authentication method. ### Attack Path 1. The user follows the printed setup instructions. 2. The user replaces `xxx` with a real token in the crontab entry. 3. The credential remains persistently stored in plaintext. 4. A local attacker, administrator-level process, diagnostic collector, backup system, or accidental disclosure obtains the crontab content. 5. The attacker uses the token with the permissions granted by its Gitee scopes. ### Impact Assessment Exposure grants access equivalent to the compromised Gitee token, potentially including repository creation and repository management. This issue does not establish unautho ...[truncated 140 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/watch-and-backup.sh:13
Finding: Predictable shared temporary files permit symlink-based overwrite and watcher disruption
Content: View full analysis
/dev/null; then echo "Watcher already running (PID: $PID)" echo "Use: kill $PID to stop" exit 1 fi fi ``` ```bash do_backup() { local reason="$1" echo "[$(date '+%Y-%m-%d %H:%M:%S')] Change detected: $reason" >> "$LOG_FILE" echo "Triggering backup..." ``` ```bash if [[ "$1" == "--daemon" ]]; then echo "Starting in daemon mode..." echo $$ > "$PID_FILE" ``` ### Technical Analysis The watcher uses fixed filenames under the shared `/tmp` directory and writes to them without secure creation, ownership verification, or symbolic-link rejection. On systems where another local user can create entries in `/tmp`, an attacker can pre-create either path as a symlink. The victim process may then append log data or write its PID through the symlink using the victim's permissions. The attacker can also place attacker-selected PID data in the predictable PID file to make the watcher report that it is already running. The write contents are constrained, so this is not a general arbitrary-content write primitive. Nevertheless, it can overwrite or append to selected writable files and can interfere with backup availability. ### Attack Path 1. A local attacker predicts `/tmp/openclaw-backup-watcher.pid` or `/tmp/openclaw-backup-watcher.log`. 2. The attacker creates a symbolic link from one of those paths to a file writable by the victim account. 3. The victim starts the watcher or triggers a backup event. 4. The script follows the symlink and writes the PID or appends a log line to the ...[truncated 555 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (21)

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The skill requires a Personal Access Token with repository-management permissions, which is a sensitive credential capable of creating and modifying repositories. Although the documentation does not directly exfiltrate the token, requesting and operationalizing such a credential materially increases the attack surface, especially in a skill designed to automate external backups.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
| 变量 | 必需 | 说明 | |------|------|------| | `GITEE_TOKEN` | 是 | Git 平台的 Personal Access Token | | `GITEE_REPO` | 是 | 仓库 URL | | `AGENT_NAME` | 是 | Agent 标识符 | | `WORKSPACE_DIR` | 否 | 工作区路径，默认 `~/.openclaw/workspace` |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/backup-to-gitee.sh (reported line 13)May include surrounding context.
sh
WORKSPACE_DIR="${WORKSPACE_DIR:-$HOME/.openclaw/workspace}" BACKUP_DIR="${BACKUP_DIR:-$HOME/.openclaw/backup-temp}" GITEE_REPO="${GITEE_REPO:-}" # e.g., https://gitee.com/username/openclaw-agent-name.git GITEE_TOKEN="${GITEE_TOKEN:-}" # Personal Access Token AGENT_NAME="${AGENT_NAME:-agent}" # For commit signature # Files to backup (relative to workspace)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup-gitee.sh (reported line 24)May include surrounding context.
sh
WORKSPACE_DIR="${WORKSPACE_DIR:-$HOME/.openclaw/workspace}" BACKUP_DIR="${BACKUP_DIR:-$HOME/.openclaw/backup-temp}" GITEE_REPO="${GITEE_REPO:-}" # e.g., https://gitee.com/username/openclaw-agent-name.git GITEE_TOKEN="${GITEE_TOKEN:-}" # Personal Access Token AGENT_NAME="${AGENT_NAME:-agent}" # For commit signature # Files to backup (relative to workspace)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/backup-to-gitee.sh (reported line 90)May include surrounding context.
sh
for dir in "${BACKUP_DIRS[@]}"; do src="$WORKSPACE_DIR/$dir" if [[ -d "$src" ]]; then rm -rf "$BACKUP_DIR/$dir" cp -r "$src" "$BACKUP_DIR/" echo " ✓ $dir/" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/backup-to-gitee.sh (reported line 99)May include surrounding context.
sh
# Create .gitignore for backup cat > "$BACKUP_DIR/.gitignore" << 'EOF' # Secrets and sensitive files .env *.key *.pem *_token*

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/create-repo.sh (reported line 19)May include surrounding context.
sh
exit 1 fi curl -s -X POST "https://gitee.com/api/v5/user/repos" \ -H "Content-Type: application/json" \ -d "{ \"access_token\": \"$GITEE_TOKEN\",

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger description is overly broad because it activates on generic terms like "git", "github", and "backup", which can appear in many unrelated conversations. This can cause the skill to be invoked unexpectedly and expose users to backup workflows involving repository creation and credential handling when they did not explicitly request that action.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The skill instructs users to send data to an external service by creating a remote repository and then backing up workspace contents to it. In this context, the transmitted data can include agent memory, skills, and core documents, which may contain sensitive operational or personal information; the danger is increased because the skill normalizes exporting these materials off-host.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
bash
# Gitee curl -X POST "https://gitee.com/api/v5/user/repos" \ -H "Content-Type: application/json" \ -d '{ "access_token": "YOUR_TOKEN",

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The header says the script 'Backs up core workspace files to Gitee repository', which suggests a limited file backup. However, the code later copies full directories listed in BACKUP_DIRS, specifically 'memory' and 'skills', materially expanding the backup scope beyond just core files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script automatically pushes workspace content to a remote repository without an explicit confirmation step, dry-run summary, or prominent warning about data exfiltration. In this context, the backed-up material includes potentially sensitive agent memory and skills, so an operator could unintentionally upload private data to an external service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/create-repo.sh (reported line 19)May include surrounding context.
sh
exit 1 fi curl -s -X POST "https://gitee.com/api/v5/user/repos" \ -H "Content-Type: application/json" \ -d "{ \"access_token\": \"$GITEE_TOKEN\",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/setup-gitee.sh (reported line 63)May include surrounding context.
sh
exit 1 fi curl -s -X POST "https://gitee.com/api/v5/user/repos" \ -H "Content-Type: application/json" \ -d "{ \"access_token\": \"$GITEE_TOKEN\",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This shell script performs a network POST request to Gitee and includes the GITEE_TOKEN credential in the transmitted payload. While repository creation is the script's purpose, the file provides no confirmation prompt, warning comment, or user-facing disclosure that credentials and repository details will be sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends the personal access token in a URL query string when calling the user API. Tokens in URLs are commonly exposed through shell history, process listings, proxy logs, web server logs, and monitoring tools, which can lead to credential leakage and unauthorized repository access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script performs an authenticated network request using a long-lived personal access token embedded in the JSON request body. While less exposed than a query string, this still risks leakage through debugging output, endpoint logging, shell tracing, or error handling and should be handled more carefully.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 92% confidence
Finding: The script advises putting GITEE_TOKEN=xxx directly into a cron entry or persistent environment, which can expose the token in crontab files, backups, process inspection, or administrative views. This encourages insecure credential persistence and increases the chance of long-term token compromise.
Content: Scanner excerpt · scripts/setup-gitee.sh (reported line 104)May include surrounding context.
sh
echo "Next steps:" echo "1. Test backup: GITEE_TOKEN=xxx ./scripts/backup-to-gitee.sh" echo "2. Add to cron for auto-backup:" echo " crontab -e" echo " # Add: 0 */4 * * * GITEE_TOKEN=xxx /path/to/backup-to-gitee.sh >> /tmp/backup.log 2>&1" echo "" echo "Or set GITEE_TOKEN in your environment for persistent use."

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script automatically invokes a credentialed remote backup operation whenever watched files change, using GITEE_TOKEN and GITEE_REPO from the environment. In a watcher/daemon context, this can exfiltrate workspace contents to a remote repository without an explicit approval step at the moment of transmission, and any process or user able to influence the watched files can trigger repeated outbound pushes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The daemonized watcher can perform background backups to a remote repository with no interactive warning or confirmation at the execution point beyond a generic log entry. Because it monitors identity, memory, user, and skills content, the data being transmitted may include sensitive agent state or user information, making silent background sync materially risky in this skill context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Large parts of the skill instructions, prerequisites, and safety notes are presented only in Chinese, while the file does not state that the skill is region- or language-specific or offer an alternative language. This can violate a language/locale policy when users are not given a choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script requires GITEE_TOKEN and uses it for authenticated repository access. While the variable name and error message indicate a token is needed, there is no explicit warning or comment describing that a personal access token will be consumed for remote authentication and embedded into the clone URL during execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The header states the script will both create a Gitee repository and configure local git for backup. In the implementation, the script fetches the username via API, attempts repository creation, and writes a local configuration file, but there are no git commands or local repository configuration steps. This is an active documentation-to-code mismatch rather than merely omitted detail because the comments enumerate specific actions the script supposedly performs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.