Openclaw Complete Backup Delete Fresh Install Restore Cycle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 2.2.1

Overview

This skill is meant for OpenClaw backup and recovery, but it includes high-impact delete, install, credential-copying, and global command replacement steps that need careful review before use.

Review before installing. Use this only on an isolated or well-backed-up OpenClaw host, avoid the curl-to-shell fallback, pin and verify packages, encrypt or tightly restrict credential backups, replace destructive deletes with reversible moves, and confirm every global binary or symlink target before changing /usr/local/bin.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:314
• Finding: Unverified Remote Installer Is Piped Directly Into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:314-316` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # If that fails, try the direct method (because npm) curl -fsSL https://cli.openclaw.ai/install.sh | sh ``` ### Technical Analysis The Skill instructs the user or agent to download a mutable shell script and immediately execute it. The installer is not pinned to an immutable release, saved for inspection, or verified using a cryptographic signature or expected digest. The effective code executed by this command can therefore change after the Skill has been reviewed. HTTPS protects the connection in transit but does not establish that every future script served by the endpoint is safe. Compromise of the hosting account, deployment pipeline, DNS infrastructure, TLS termination environment, or installer itself would turn this instruction into an arbitrary-code-execution channel. The Skill declares root or sudo access as a prerequisite. Although `sh` does not explicitly use `sudo`, users may invoke the workflow from a root shell, substantially increasing the potential impact. ### Attack Path 1. An attacker compromises the installer host, its deployment pipeline, or another component controlling the response from `https://cli.openclaw.ai/install.sh`. 2. The attacker replaces or modifies the installer with commands that steal credentials, alter binaries, install persistence, or destroy data. 3. A user or agent follows the Skill and executes the documented `curl | sh` command. 4. The remote response is passed directly to the shell without validation. 5. The attacker's commands execute with the privileges of the invoking account, potentially including root privileges. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. In the expected root/sudo operating context, an attacker could obtain complete host control, access ...[truncated 145 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct pipe from `curl` to `sh`. - Use an immutable, version-specific installer URL rather than a mutable latest installer. - Download the installer to a local file before execution. - Verify an expected SHA-256 digest or, preferably, a signature tied to a trusted publisher key. - Present the script for review before executing it. - Abort when verification fails; do not silently fall back to remote execution. - Run installation under the least-privileged account possible and elevate only individual operations that require it. - Prefer a signed operating-system package or a version-pinned package-manager installation. A safer pattern is: ```bash curl -fL -o /tmp/openclaw-install.sh \ "https://cli.openclaw.ai/releases/<fixed-version>/install.sh" printf '%s %s\n' '<reviewed-sha256>' /tmp/openclaw-install.sh | sha256sum -c - chmod 700 /tmp/openclaw-install.sh /bin/sh /tmp/openclaw-install.sh ``` ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:94
• Finding: Credentials and API Keys Are Duplicated Into Unencrypted Backups<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:94-100`, `SKILL.md:167-168`, `SKILL.md:220`, and `SKILL.md:421-424` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: High ### Vulnerable Code ```bash # Category 1: CREDENTIALS & API KEYS (Most critical) echo "1. Backing up credentials & API keys..." mkdir -p "$BACKUP_ROOT/01_CREDENTIALS_API_KEYS" if [ -d ~/.openclaw/credentials ]; then cp -r ~/.openclaw/credentials/* "$BACKUP_ROOT/01_CREDENTIALS_API_KEYS/" echo " ✅ Credentials backed up" else echo " ⚠️ No credentials directory found" fi ``` Additional backup and restoration instructions repeat this behavior: ```bash # Restore credentials only: cp -r "$BACKUP_ROOT/01_CREDENTIALS_API_KEYS/"* ~/.openclaw/credentials/ ``` ```bash cp -r credentials/* /root/BACKUPS/$(date +%Y-%m-%d)_OpenClaw_Configurations_Only/01_CREDENTIALS_API_KEYS/ ``` ```bash echo "1. Restoring credentials & API keys..." if [ -d "$INTELLIGENT_BACKUP/01_CREDENTIALS_API_KEYS" ]; then mkdir -p ~/.openclaw/credentials cp -r "$INTELLIGENT_BACKUP/01_CREDENTIALS_API_KEYS/"* ~/.openclaw/credentials/ fi ``` ### Technical Analysis Credential access is functionally related to a complete backup and restore operation. However, the implementation duplicates all credential files into ordinary directories without encryption, an explicit restrictive `umask`, destination permission enforcement, ownership validation, retention controls, or secure disposal instructions. `mkdir -p` is used without an explicit mode, and copied objects may retain or receive permissions influenced by source metadata and the current process environment. The backup directories may subsequently be included in snapshots, copied to other systems, archived, or read by privileged backup services. Every additional plaintext copy increases the number of locations from which API keys or channel credentials can be recovered. The use of `*` also omits hidden files and does not ...[truncated 1148 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit user approval before including credentials in any backup. - Set `umask 077` before creating backup files. - Create secret-bearing directories with mode `0700` and secret files with mode `0600`. - Encrypt secret backups using a recipient-controlled mechanism such as age, GPG, or an approved secret-management system. - Keep encryption keys separate from the backup. - Validate that the backup root is owned by the expected user and is not a symlink. - Use `cp -a --` with controlled source paths or a carefully constructed archive instead of unqualified globs. - Generate and verify a manifest so omitted hidden files and unexpected objects are detected. - Establish explicit retention and secure disposal procedures for credential-bearing backups. - Restore credentials only after validating destination ownership and permissions. - Recommend credential rotation if a plaintext backup is lost, shared, or exposed. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:300
• Finding: Broad Destructive Deletion Can Remove Unrelated Tools or Application State<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:300-302` and `SKILL.md:413-418` **Vulnerability Type**: Unsafe destructive file operations **Risk Level**: High ### Vulnerable Code ```bash # Clean up any stray files (they're like glitter) find /usr/local/bin -name "*openclaw*" -delete 2>/dev/null || true ``` The restoration workflow also deletes the active application state: ```bash # Create fresh .openclaw directory rm -rf ~/.openclaw mkdir -p ~/.openclaw ``` ### Technical Analysis The `/usr/local/bin` cleanup uses a wildcard name match rather than an exact list of package-owned paths. It can delete unrelated executables whose names merely contain `openclaw`. Error suppression and `|| true` conceal failures and reduce auditability. The recursive deletion of `~/.openclaw` is consistent with a clean restoration in principle, but it is executed without an immediately coupled check proving that the selected backup is complete, readable, authentic, and restorable. If backup creation omitted files, was interrupted, or selected the wrong source, the command can irreversibly destroy the active copy. These operations are especially consequential because the Skill expects root/sudo access and handles credentials, databases, workspaces, and agent configuration. ### Attack Path **Wildcard executable deletion:** 1. An unrelated legitimate executable exists in `/usr/local/bin` with `openclaw` anywhere in its filename. 2. The user follows the purge instructions. 3. `find ... -delete` removes that executable without package-ownership validation or confirmation. 4. The associated application or administrative workflow stops functioning. **State-loss path:** 1. A backup is incomplete, corrupt, stale, or missing required hidden files. 2. The restoration branch still executes `rm -rf ~/.openclaw`. 3. The only current copy of credentials, configuration, database content, or workspace data is destroyed. 4. Restoration fails or silently returns an incomple ...[truncated 609 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove only exact paths recorded as belonging to the installed package. - Prefer package-manager uninstall operations over filesystem wildcard deletion. - Resolve every target with `realpath` and reject targets outside an explicit allowlist. - Print the complete deletion plan and require explicit confirmation. - Do not suppress deletion errors during security-sensitive cleanup. - Before deleting `~/.openclaw`, verify that: - the backup exists and is readable; - a manifest is present and valid; - expected credentials, configuration, and database entries are included; - cryptographic integrity checks pass; - a sandbox restoration succeeds. - Rename the current directory to a quarantine path instead of immediately deleting it. - Retain the quarantined state until post-restoration health checks pass. - Add filesystem boundary checks so empty, unset, or unexpected variables cannot change the deletion target. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:337
• Finding: Ambiguous Executable Discovery Can Replace a Trusted Global Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:337-343`, `SKILL.md:349-358`, and `SKILL.md:368-374` **Vulnerability Type**: Local tool hijacking **Risk Level**: High ### Vulnerable Code ```bash # Check for openclaw.mjs file OPENCLAW_MJS=$(find /usr/lib/node_modules -name "openclaw.mjs" 2>/dev/null | head -1) if [ -n "$OPENCLAW_MJS" ]; then echo "Found openclaw.mjs at: $OPENCLAW_MJS" # Create symlink sudo ln -sf "$OPENCLAW_MJS" /usr/local/bin/openclaw sudo chmod +x /usr/local/bin/openclaw echo "✅ Created symlink: /usr/local/bin/openclaw → $OPENCLAW_MJS" ``` A second fallback similarly searches for a package file and replaces the global command: ```bash BIN_PATH=$(find /usr/lib/node_modules -name "$BIN_ENTRY" -path "*openclaw*" 2>/dev/null | head -1) if [ -n "$BIN_PATH" ]; then sudo ln -sf "$BIN_PATH" /usr/local/bin/openclaw sudo chmod +x /usr/local/bin/openclaw echo "✅ Created symlink to: $BIN_PATH" fi ``` ### Technical Analysis The workflow trusts the first file returned by a broad filesystem search based primarily on filename. It does not confirm that the result belongs to the intended npm package, matches a reviewed version, has trusted ownership, is not a symlink to another location, or passes an integrity check. The selected file is then exposed as `/usr/local/bin/openclaw` using `sudo ln -sf`. This forcefully replaces a globally trusted command. Users, automation, and services may subsequently execute the selected JavaScript while believing they are invoking the legitimate OpenClaw CLI. The fallback wrapper at `SKILL.md:716-723` repeats the same weak first-match discovery principle, although it does not itself create the privileged symlink. ### Attack Path 1. An attacker or compromised package places a file named `openclaw.mjs` under a searched `/usr/lib/node_modules` path. 2. Filesystem traversal returns the attacker-controlled file before the legitimate executable. 3. The Skill assigns that f ...[truncated 880 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not select executables using `find ... | head -1`. - Resolve the executable through the package manager and a single exact expected package path. - Pin the expected package name and version. - Verify npm package integrity and ownership before linking. - Reject multiple matching candidates rather than choosing the first one. - Use `realpath` and ensure the resolved target remains inside the exact trusted package directory. - Reject targets that are writable by unprivileged users. - Do not use `ln -sf` to overwrite an existing global command without explicit approval and validation. - Prefer the package manager's supported binary-linking mechanism. - If a wrapper is necessary, configure it with one immutable, validated executable path rather than dynamic filesystem discovery. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:308
• Finding: Unpinned Global npm Installations Expose the Host to Supply-Chain Compromise<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:308-310`, `SKILL.md:388`, `SKILL.md:727`, and `SKILL.md:860` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install via npm (the official way) npm install -g @martian-engineering/lossless-claw ``` The troubleshooting guidance also recommends additional unpinned global installations: ```bash echo " sudo npm install -g openclaw --verbose" ``` ```bash echo "❌ OpenClaw not found. Try: sudo npm install -g @martian-engineering/lossless-claw" ``` ```bash npm install -g @sinclair/typebox ``` The last command appears in guidance that recommends installing whatever dependency an error reports. ### Technical Analysis The installations do not specify reviewed package versions, lock dependencies to known artifacts, or validate package integrity independently of the registry. Global installation broadens the effect of a compromised package, while npm lifecycle scripts may execute during installation. The recommendation to install “whatever it complains about” is particularly unsafe because package names can be influenced by misleading diagnostics, compromised application output, or dependency-confusion conditions. The alternative `openclaw` package name is also different from the primary scoped package and is not authenticated or justified by the Skill. ### Attack Path 1. An attacker compromises an npm publisher account, package release, transitive dependency, or registry delivery path. 2. Alternatively, malicious output persuades the operator to install an attacker-selected package matching a reported missing dependency. 3. The user follows the Skill and performs an unpinned global npm installation, potentially using `sudo`. 4. npm downloads the current package and its dependency graph. 5. Malicious lifecycle scripts or package code execute during installation or when the global command is later invoked. 6. The malicious com ...[truncated 611 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every direct dependency to a reviewed exact version. - Use a lockfile or other integrity-controlled dependency manifest. - Verify package provenance, signatures, and registry integrity metadata. - Use a controlled internal registry or allowlist where practical. - Avoid global installation and root execution; install into a dedicated, unprivileged application environment. - Disable npm lifecycle scripts with `--ignore-scripts` when package functionality permits. - Review lifecycle scripts before allowing them to run. - Remove the recommendation to install arbitrary packages based solely on diagnostic output. - Use only the documented, verified package identity; do not suggest an alternate similarly named package without validating its ownership and purpose. - Re-audit and test dependencies before upgrading pinned versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (41)

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill launches into backup, deletion, reinstall, and credential-copying workflows without a clear upfront warning that it may destroy local state and expose secrets. In context, this is dangerous because operators may follow copy-paste instructions before understanding that they are deleting application data and handling sensitive credential material.

Chaining Abuse

High

• Category: Tool Misuse

Content

npm uninstall -g @martian-engineering/lossless-claw 2>/dev/null || echo "Not installed via npm, moving on..."

# Remove any remaining binaries
which openclaw && rm -f "$(which openclaw)" || echo "Binary already gone"

# Clean up any stray files (they're like glitter)
find /usr/local/bin -name "*openclaw*" -delete 2>/dev/null || true

• Confidence: 92% confidence
• Finding: `which openclaw && rm -f "$(which openclaw)"` chains discovery and deletion into a single expression, increasing the risk of removing an unexpected binary if PATH resolution is manipulated or misunderstood. The compact one-liner discourages inspection of the resolved path before deletion.

External Script Fetching

High

• Category: Supply Chain

Content

openclaw --version

# If that fails, try the direct method (because npm)
curl -fsSL https://cli.openclaw.ai/install.sh | sh
```

### Step 9: Initial Configuration & Binary Fix

• Confidence: 99% confidence
• Finding: `curl -fsSL https://cli.openclaw.ai/install.sh | sh` executes a remote script directly in the shell without prior review, pinning, or integrity verification. This is a classic supply-chain and remote code execution hazard: compromise of the host, DNS, TLS trust chain, or upstream script immediately turns the skill into an arbitrary code execution path with the user's privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

openclaw --version

# If that fails, try the direct method (because npm)
curl -fsSL https://cli.openclaw.ai/install.sh | sh
```

### Step 9: Initial Configuration & Binary Fix

• Confidence: 99% confidence
• Finding: Piping a fetched network resource directly into `sh` combines retrieval and execution into one unreviewable action. This removes opportunities for inspection, signature validation, and version control, making upstream compromise immediately exploitable.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Restoring from categorized backup: $INTELLIGENT_BACKUP"
    
    # Create fresh .openclaw directory
    rm -rf ~/.openclaw
    mkdir -p ~/.openclaw
    
    # Restore by category (selective tick-box restoration!)

• Confidence: 97% confidence
• Finding: `rm -rf ~/.openclaw` is a destructive deletion primitive that permanently removes application state prior to confirming successful restoration. In this skill's context it is especially dangerous because the same document also promotes selective and evolving workflows, increasing the chance of copy-paste execution against the wrong environment or with incomplete backups.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Restoring from categorized backup: $INTELLIGENT_BACKUP"
    
    # Create fresh .openclaw directory
    rm -rf ~/.openclaw
    mkdir -p ~/.openclaw
    
    # Restore by category (selective tick-box restoration!)

• Confidence: 97% confidence
• Finding: `rm -rf ~/.openclaw` is a destructive deletion primitive that permanently removes application state prior to confirming successful restoration. In this skill's context it is especially dangerous because the same document also promotes selective and evolving workflows, increasing the chance of copy-paste execution against the wrong environment or with incomplete backups.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Keep only last 3 backups (hoarding is a disease)
cd /root/backups/openclaw
ls -t openclaw-backup-*.tar.gz | tail -n +4 | xargs rm -f

# Update retention in script (if you're feeling thorough)
sed -i 's/RETENTION_DAYS=7/RETENTION_DAYS=3/' /usr/local/bin/openclaw-backup

• Confidence: 86% confidence
• Finding: `ls -t ... | tail -n +4 | xargs rm -f` chains file selection and deletion in a way that can remove unintended files if globbing, whitespace, or directory assumptions do not hold. In backup management, accidental deletion of recovery artifacts can materially worsen outage impact.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The metadata markets the skill as 'safety-first' and 'tested in production' while the body contains destructive deletion, root-level changes, and `curl | sh` remote execution. That mismatch can lower operator caution and increase the chance that high-risk actions are run without appropriate validation or rollback planning.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest trigger uses loose natural-language conditions such as 'when OpenClaw has become a bit... temperamental' and 'it's looking tired', which do not clearly define when the skill should or should not activate. The listed prompts are also broad maintenance phrases that could match many ordinary troubleshooting situations without clear scope boundaries or exclusion cases.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Clean up corrupted installation (again?)
prerequisites:
  - OpenClaw installed and running (for now)
  - Root/sudo access (because we're not messing about)
  - Disk space for backups (2x .openclaw size, plus a bit for luck)
  - Improved backup scripts installed (openclaw-backup, openclaw-restore)
pitfalls:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 🎯 WORKFLOW B: CLEAN INSTALL WITH DELAYED SELECTIVE RESTORE
*(For when you want: Backup → Delete → Fresh Install → Work → Restore selectively later)*

### B1: Create Intelligent Categorized Backup
```bash
echo "=== CREATING CATEGORIZED BACKUP FOR SELECTIVE RESTORE ==="
echo "Backing up in categories so you can restore only what you need later..."

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Backup agent configs but NOT their workspaces (too big)
    find ~/.openclaw/agents -name "*.json" -type f | while read file; do
        rel_path="${file#~/.openclaw/agents/}"
        mkdir -p "$BACKUP_ROOT/03_AGENT_IDENTITIES/$(dirname "$rel_path")"
        cp "$file" "$BACKUP_ROOT/03_AGENT_IDENTITIES/$rel_path"
    done
    echo "   ✅ Agent configs backed up (excluding workspaces)"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Category 5: TELEGRAM & CHANNEL CONFIGS
echo "5. Backing up Telegram & channel configs..."
mkdir -p "$BACKUP_ROOT/05_CHANNEL_CONFIGS"
if [ -d ~/.openclaw/telegram ]; then
    cp -r ~/.openclaw/telegram/* "$BACKUP_ROOT/05_CHANNEL_CONFIGS/" 2>/dev/null || true
    echo "   ✅ Telegram configs backed up"

• Confidence: 90% confidence
• Finding: Persisting Telegram and channel configuration into a backup location can store bot tokens, chat identifiers, and other sensitive integration state in plaintext under `/root/BACKUPS`. In context this is part of the intended workflow, but it increases secret exposure if the backup directory is later copied, browsed, or retained insecurely.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "   ✅ Telegram configs backed up"
fi

# Create backup manifest
cat > "$BACKUP_ROOT/00_BACKUP_MANIFEST.md" << EOF
# OPENCLAW SELECTIVE BACKUP MANIFEST
Backup created: $(date)

• Confidence: 90% confidence
• Finding: The generated manifest embeds restoration instructions and backup locations alongside references to categories containing credentials and channel configs. While useful operationally, it creates durable metadata that can help an attacker locate and restore sensitive material if the backup store is exposed.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 9: Initial Configuration & Binary Fix
```bash
# Initialize with minimal config
mkdir -p ~/.openclaw
echo '{"gateway": {"port": 3000}}' > ~/.openclaw/openclaw.json

# Set proper permissions (OpenClaw is fussy)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo '{"gateway": {"port": 3000}}' > ~/.openclaw/openclaw.json

# Set proper permissions (OpenClaw is fussy)
chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

# FIX OPENCLAW COMMAND ISSUE (Common after npm install)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Set proper permissions (OpenClaw is fussy)
chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

# FIX OPENCLAW COMMAND ISSUE (Common after npm install)
echo "=== OPENCLAW COMMAND TROUBLESHOOTING ==="

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

openclaw --version 2>&1 | head -2 || echo "⚠️  Command exists but doesn't run"
else
    echo "❌ OpenClaw command still not found. Try reinstalling:"
    echo "   sudo npm install -g openclaw --verbose"
    echo "   Or use: node /usr/lib/node_modules/openclaw/openclaw.mjs"
fi
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

openclaw --version 2>&1 | head -2 || echo "⚠️  Command exists but doesn't run"
else
    echo "❌ OpenClaw command still not found. Try reinstalling:"
    echo "   sudo npm install -g openclaw --verbose"
    echo "   Or use: node /usr/lib/node_modules/openclaw/openclaw.mjs"
fi
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.