openclaw2backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:01 AM UTC
• Version: 1.0.1

Overview

This backup skill is not malicious, but it needs Review because it can bundle sensitive wallet, memory, configuration, and repository data into backups without adequate safety warnings.

Before installing, treat generated backups as sensitive secrets bundles. Use encrypted storage, avoid sharing or syncing unencrypted archives, review whether wallet, memory, openclaw.json, and .git history should be included, and run restore/delete operations only after confirming what will be overwritten or removed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:91

Finding

Unencrypted Backups May Expose Wallet, Memory, Configuration, and Repository Secrets

Content

View full analysis

Vulnerability Details

File Location: README.md:91-101, README.md:164-170, SKILL.md:30-35, and SKILL.md:91-99
Vulnerability Type: Plaintext storage of sensitive information
Risk Level: High

Vulnerable Documentation Excerpts

The following is an English rendering of the documented backup scope in README.md:91-101:

text

Quick backup includes:
- All installed Skills
- Workspace configuration, excluding node_modules
- openclaw.json
- FluxA Wallet configuration, if present
- Memory files, including MEMORY.md and daily files

Full backup additionally includes:
- node_modules
- The .git directory
- All build artifacts

The storage recommendation in README.md:164-170 states:

text

It is recommended to synchronize backup files to external storage or a cloud drive.

The corresponding full-backup behavior in SKILL.md:30-35 is:

text

Full backup:
- Includes node_modules
- Includes all project files
- Includes the .git directory
- Intended for migration to a new device
- Automatically removes old backups, retaining the latest three

The documented backup output in SKILL.md:91-99 includes:

text

Back up OpenClaw configuration:
- openclaw.json

Back up FluxA Wallet:
- FluxA configuration

Technical Analysis

The documented backup process archives several classes of potentially sensitive data:

• openclaw.json may contain API tokens, service credentials, operational configuration, or private endpoints.
• FluxA Wallet configuration may contain wallet credentials, recovery information, private keys, or other data that can facilitate access to cryptocurrency assets.
• MEMORY.md and daily memory files may contain private user information, conversation-derived data, operational instructions, or retained secrets.
• The .git directory preserves complete repository history, including deleted files and secrets that are no longer ...[truncated 2886 chars]

Remediation

View remediation

Remediation Suggestions

1. Exclude sensitive resources by default

   • Do not include wallet configuration, private keys, seed phrases, credentials, tokens, memory files, or .git history in the default backup profile.
   • Require explicit, per-category user consent before including sensitive resources.

2. Encrypt every sensitive backup

   • Use authenticated encryption, such as AES-256-GCM, rather than relying on ordinary ZIP packaging.
   • Obtain the encryption secret interactively or through a dedicated secure secret store.
   • Never embed encryption keys in the archive, scripts, configuration files, command history, or manifest.
   • Document secure key storage and recovery requirements.

3. Apply strict access controls

   • Create archives and temporary directories with permissions limited to the invoking user.
   • Validate that the destination is not globally readable before writing.
   • Refuse insecure destinations or require explicit confirmation with a clear warning.

4. Protect temporary data

   • Avoid writing unencrypted intermediate copies where possible.
   • Create temporary directories using secure platform APIs.
   • Remove temporary data reliably after success or failure.
   • Document that deletion may not securely erase data from all storage media.

5. Add secret detection and redaction

   • Scan configuration, project files, and Git history for API keys, credentials, wallet secrets, and private keys before archiving.
   • Abort or request explicit confirmation when high-risk secrets are detected.
   • Provide configurable exclusion patterns for sensitive files.

6. Harden cloud-storage guidance

   • Do not recommend cloud synchronization unless the archive is encrypted before upload.
   • Warn users that cloud-provider account compromise can expose retained backups.
   • Recommend multifactor authentication, limited sharing, retention controls, and client-side e ...[truncated 363 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Restore operations inherently risk overwriting existing workspace, configuration, and skill data, and the documentation does not prominently warn about that consequence. Because this skill handles broad workspace recovery, an uninformed restore could replace current data, reintroduce stale or unsafe files, or cause significant operational disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly states that backups include highly sensitive materials such as wallet configuration, memory files, installed skills, configuration, and potentially .git and dependency trees, but it does not warn users about the confidentiality risks of storing or syncing those archives. In a backup skill, this omission is security-relevant because users may place archives on external drives or cloud storage without realizing they may contain secrets, tokens, personal data, or proprietary code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Most of the natural-language instructions, headings, and examples are presented in Chinese, which effectively imposes a language requirement on users reading the skill documentation. The file does not state that the skill is intended only for a Chinese-speaking audience or provide an alternative language/opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises deletion of backups but does not clearly warn that this is a destructive, irreversible action. In a backup-management context, unclear deletion semantics can lead users or agent workflows to remove the only recoverable copies of workspace or configuration data.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The trigger list includes several phrases, but the later usage example '显示所有备份' is not listed among the official triggers, making it unclear which phrasings actually activate the skill. The documentation also does not provide exclusions or negative examples to distinguish valid invocations from nearby everyday backup-related requests.

Content

No source excerpt is available for this finding.