OpenClaw Complete Backup & Restore Cycle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 2.2.0

Overview

The skill is a backup and restore guide, but it includes high-impact reinstall and restore commands without enough verification or guardrails.

Review this skill carefully before installing or following it. The main risks are the one-line remote installer and wildcard tar restores; use only a verified official installer, prefer pinned packages or checksums/signatures, inspect downloaded scripts before running them, specify exact backup files, and restore into a temporary staging directory before copying files into `~/.openclaw`.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:44

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -sSL https://install.openclaw.ai | bash

Technical Analysis

The installation command streams content retrieved from an external server directly into Bash. The -L option also follows HTTP redirects, so the executed payload may originate from a different endpoint. The instructions do not pin an installer version, validate a cryptographic checksum, verify a publisher signature, or give the user an opportunity to inspect the downloaded script.

Consequently, the effective code executed by this audited Skill can change without any change to the repository. The apparent relationship between the hostname and the product does not establish the trustworthiness or immutability of the returned payload.

This behavior exceeds the minimum capability needed for backup and restoration. Even if reinstallation is part of the declared workflow, it does not require immediate execution of an unverified, mutable network response.

Attack Path

1. A user follows the documented fresh-install workflow.
2. The user runs the curl | bash command.
3. The installer endpoint, a redirect destination, DNS resolution, or associated hosting infrastructure returns compromised or malicious shell code.
4. Bash executes the response immediately without authenticity or integrity validation.
5. The payload performs arbitrary actions with the permissions of the invoking user and may request or use elevated privileges if the user grants them.

Impact Assessment

A malicious payload can obtain code execution with the invoking user's privileges. This may permit access to user-readable credentials and configuration, modification or deletion of files, data exfiltration, installation of additional payloads, and modification of the OpenClaw installation. System-wide impact ...[truncated 110 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the pipeline with a version-pinned installer or operating-system package from a documented official release channel.
2. Download the artifact to a local file rather than piping it into a shell.
3. Verify a publisher signature and a trusted, version-specific SHA-256 checksum before execution.
4. Display or inspect the downloaded script before running it.
5. Reject unexpected redirects, especially cross-origin redirects.
6. Run the installer without elevated privileges by default. Elevate only narrowly scoped operations that demonstrably require it.
7. Document the expected source, version, signature key, checksum, and installer behavior.

A safer general workflow is:

bash

curl --fail --show-error --location \
  --output openclaw-installer.sh \
  "https://trusted.example/openclaw/releases/PINNED_VERSION/install.sh"

echo "EXPECTED_SHA256  openclaw-installer.sh" | sha256sum --check -
less openclaw-installer.sh
bash openclaw-installer.sh

The project must supply a real pinned version and independently trusted checksum or signature rather than placeholders.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/quick-reference.md:34

Finding

Quick Reference Recommends Unverified Remote Code Execution

Content

View full analysis

Vulnerability Details

File Location: references/quick-reference.md:34
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

markdown

3. `curl -sSL https://install.openclaw.ai | bash`

Technical Analysis

The quick-reference instructions independently reproduce the unsafe installation pattern. Content received from a mutable external URL is passed directly to Bash, with redirects enabled and without checksum validation, signature verification, version pinning, or review.

Because users may rely on the quick reference without consulting the main documentation, correcting only SKILL.md would leave the dangerous execution path available. The remote response can change after this package has been reviewed.

Attack Path

1. A user selects the documented fresh-install scenario.
2. The user executes the inline installation command.
3. A compromised endpoint, redirect target, DNS path, or hosting environment supplies attacker-controlled shell commands.
4. Bash executes those commands immediately.
5. The payload accesses or modifies resources available to the invoking account and may attempt to obtain additional privileges.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking account. Potential consequences include credential theft, configuration or backup access, data exfiltration, destructive filesystem changes, and installation of persistent secondary payloads. System-level compromise would require the payload to obtain elevated privileges, such as through user approval or another weakness.

Remediation

View remediation

Remediation Suggestions

Remove the curl | bash instruction from every copy of the installation workflow. Replace it with a consistent process that:

• Uses a version-pinned package or installer.
• Downloads the artifact without executing it.
• Validates a trusted publisher signature and version-specific checksum.
• Allows inspection before execution.
• Avoids unexpected or cross-origin redirects.
• Runs with ordinary user privileges unless a documented step specifically requires elevation.

Keep the quick-reference instructions synchronized with the hardened installation procedure in SKILL.md.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52

Finding

Backup Archives Are Restored Directly into the Home Directory Without Provenance Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52-55
Vulnerability Type: Unsafe archive selection and extraction
Risk Level: Medium

Vulnerable Code:

bash

# 1. Restore configurations
tar -xzf openclaw-config-backup-*.tar.gz -C ~/

# 2. Restore skills
tar -xzf openclaw-skills-backup-*.tar.gz -C ~/

Technical Analysis

The restore procedure uses wildcard archive names and extracts the selected content directly into the user's home directory. It does not require one explicit archive, authenticate its provenance, validate a cryptographic checksum, or inspect archive members and links before extraction.

A wildcard may select an unintended or attacker-planted matching file. Multiple matches can also cause ambiguous or failed command behavior rather than reliably selecting the desired backup. Direct extraction gives archive-controlled paths, file contents, permissions, and links an opportunity to affect the restoration target.

The documented backup command archives ~/.openclaw/config/ or ~/.openclaw/skills/ as supplied paths. Depending on path expansion and tar behavior, leading path components may be stored in a form that does not restore to the intended ~/.openclaw location when extracted with -C ~/. This can make recovery unreliable even without an attacker.

Attack Path

1. An attacker or another process places a crafted archive with a matching filename in the directory where restoration will run.
2. The user runs the documented wildcard extraction command.
3. The wildcard resolves to the unintended archive, or archive ambiguity prevents selection of the intended backup.
4. The crafted archive is extracted directly into the user's home restoration scope.
5. Files in the affected target are introduced or overwritten subject to the invoking user's permissions and the protections implemented by the installed tar version.

Impact Assessment

Exploitation can modify or intro ...[truncated 448 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the operator to specify exactly one archive path; do not use a wildcard for extraction.
2. Record a SHA-256 checksum when creating each backup and verify it before restoration. Use a digital signature where backups cross trust boundaries.
3. List archive members before extraction and reject absolute paths, parent-directory traversal components, device entries, and unsafe symbolic or hard links.
4. Extract into a newly created temporary staging directory first.
5. Inspect the staged directory and then copy only the expected config or skills tree into ~/.openclaw.
6. Avoid preserving unexpected ownership or privileged permission metadata.
7. Create archives using paths relative to ~/.openclaw, for example:

   bash

   tar -C "$HOME/.openclaw" -czf openclaw-config-backup-YYYYMMDD.tar.gz config
   

8. Abort when the destination already contains conflicting files unless the operator explicitly approves replacement.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/quick-reference.md:18

Finding

Quick Reference Uses Unsafe Wildcard Archive Restoration

Content

View full analysis

Vulnerability Details

File Location: references/quick-reference.md:18-21
Vulnerability Type: Unsafe archive selection and extraction
Risk Level: Medium

Vulnerable Code:

bash

# Restore configs
tar -xzf openclaw-config-backup-*.tar.gz -C ~/

# Restore skills
tar -xzf openclaw-skills-backup-*.tar.gz -C ~/

Technical Analysis

The quick-reference restore commands select archives through filename wildcards and extract them directly into the user's home directory. Structural archive verification with tar -tzf is not equivalent to validating provenance, cryptographic integrity, member paths, entry types, links, ownership, or permissions.

An unintended matching archive may be selected, while multiple matching files can produce ambiguous or failed behavior. Extracting without a staging and validation phase increases the risk that archive-controlled content will overwrite or introduce files in the restoration scope. The documented backup and extraction path combination may also recreate unexpected path prefixes rather than the intended ~/.openclaw/config and ~/.openclaw/skills directories.

Attack Path

1. A crafted or unintended archive is placed in the working directory under a matching filename.
2. The user follows the quick-reference restore instructions.
3. Shell wildcard expansion selects the unintended file or produces an ambiguous set of arguments.
4. If the crafted archive is selected, its entries are extracted into the home-directory restoration scope.
5. Attacker-controlled content modifies resources writable by the user.

Impact Assessment

The issue can result in modification of OpenClaw configuration or skill files, restoration failure, attacker-controlled skill content, or other changes within the user's writable extraction scope. It does not independently grant permissions beyond those of the invoking account.

Remediation

View remediation

Remediation Suggestions

Replace both wildcard commands with a validated restoration procedure:

• Accept exactly one explicit archive filename.
• Verify its trusted checksum or signature.
• Enumerate and validate all archive members before extraction.
• Reject absolute paths, traversal components, devices, and unsafe links.
• Extract into a temporary staging directory.
• Confirm that only the expected config or skills subtree exists.
• Copy the validated subtree into ~/.openclaw with controlled ownership and permissions.
• Keep this quick reference synchronized with the hardened procedure in the primary Skill documentation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill fetches an external script from the network and executes it immediately. This creates a direct arbitrary-code-execution path controlled by the remote endpoint and is especially dangerous here because it occurs during a reinstall workflow where users are primed to run commands with trust and urgency.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

sudo apt remove openclaw -y

# 2. Fresh install
curl -sSL https://install.openclaw.ai | bash

# 3. Verify installation
openclaw --version

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash chain removes the user's opportunity to inspect the downloaded content before execution and turns any network or source compromise into immediate shell execution. In a backup/restore skill this is more dangerous because users may run it during recovery scenarios when caution is reduced and system state is already sensitive.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

sudo apt remove openclaw -y

# 2. Fresh install
curl -sSL https://install.openclaw.ai | bash

# 3. Verify installation
openclaw --version

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Fetching and executing an external script in one step is a well-known unsafe pattern because it grants immediate execution to remote content without validation. In a quick-reference document, this is especially dangerous because users are encouraged to copy and run the command exactly as written.

Content

Scanner excerpt · references/quick-reference.md (reported line 34)May include surrounding context.

md

### Scenario 1: Fresh Install
1. Backup everything
2. `sudo apt remove openclaw -y`
3. `curl -sSL https://install.openclaw.ai | bash`
4. Restore backups

### Scenario 2: Migration

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document recommends piping a remotely fetched script directly into bash, which executes unverified code from the network immediately. If the remote endpoint, transport path, or hosting account is compromised, users could execute arbitrary commands on their system with little opportunity to inspect the script first.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash

# 1. Remove old installation (carefully!)
# WARNING: This is the point of no return
sudo systemctl stop openclaw
sudo apt remove openclaw -y

# 2. Fresh install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash

# 1. Remove old installation (carefully!)
# WARNING: This is the point of no return
sudo systemctl stop openclaw
sudo apt remove openclaw -y

# 2. Fresh install

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to execute a remotely fetched installer directly with curl ... | bash and does not include any warning or integrity verification step. This is dangerous because any compromise of the remote host, TLS interception in a hostile environment, or installer-side mistake results in immediate arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

tar -xzf openclaw-skills-backup-*.tar.gz -C ~/

Verify restore

ls -la ~/.openclaw/config/ ~/.openclaw/skills/

text

## Common Scenarios

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

tar -xzf openclaw-skills-backup-*.tar.gz -C ~/

Verify restore

ls -la ~/.openclaw/config/ ~/.openclaw/skills/

text

## Common Scenarios

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/quick-reference.md (reported line 26)May include surrounding context.

tar -xzf openclaw-skills-backup-*.tar.gz -C ~/

Verify restore

ls -la ~/.openclaw/config/ ~/.openclaw/skills/

text

## Common Scenarios

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The documentation instructs users to run a privileged command via sudo, which can make any mistake in the command or surrounding procedure system-impacting. Although package removal may legitimately require elevated privileges, presenting it as a quick-reference step without stronger guardrails increases the risk of accidental misuse.

Content

Scanner excerpt · references/quick-reference.md (reported line 33)May include surrounding context.

md

### Scenario 1: Fresh Install
1. Backup everything
2. `sudo apt remove openclaw -y`
3. `curl -sSL https://install.openclaw.ai | bash`
4. Restore backups

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick reference instructs users to run a destructive package removal command as part of a 'Fresh Install' flow without clearly warning that it uninstalls software and may remove related components. In operational docs, terse commands can be copy-pasted blindly, increasing the chance of accidental disruption or data loss during reinstall procedures.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/quick-reference.md (reported line 51)May include surrounding context.

md

## Safety Tips

1. **Always** create dual backups
2. **Always** verify tar integrity
3. **Never** delete originals until restore verified
4. **Always** test restore on test system first

Static analysis

No suspicious patterns detected.