Security audit

Openclaw Backup Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate local backup skill, but it needs review because its script can mishandle backup files in shared directories and its archives may contain sensitive OpenClaw data.

Use only a private, access-controlled backup directory, preferably the default; do not run the script as root; treat archives as sensitive because they include workspace context and OpenClaw config; run prune in dry-run mode first and review any scheduled-job changes before applying them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/openclaw-backup.sh:457
Finding: Predictable Backup Files Permit Symbolic-Link File Modification
Content: View full analysis
> "$log_path" printf '[openclaw-backup] Resolved workspace: %s\n' "$WORKSPACE" >> "$log_path" enable_log_tee "$log_path" log "Backup mode: $backup_mode_label" # Stage backup contents in a temporary directory before packing the archive. staging_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-backup.XXXXXXXX")" ``` ```bash log "Creating temporary archive: $temp_archive_path" tar -C "$staging_dir" -czf "$temp_archive_path" "$archive_basename" [[ -s "$temp_archive_path" ]] || fail "Temporary archive was created but is empty: $temp_archive_path" log "Verifying temporary archive readability" tar -tzf "$temp_archive_path" >/dev/null log "Finalizing archive: $final_archive_path" mv -- "$temp_archive_path" "$final_archive_path" ``` ### Technical Analysis The staging directory is securely generated with `mktemp`, and `umask 077` protects newly created files. However, the log and temporary archive paths are derived from a UTC timestamp with one-second precision and predictable suffixes: - `openclaw-light-backup-.log` - `openclaw-light-backup-.tar.gz.part` The script does not create these files exclusively and does not reject existing files or symbolic links. An explicitly supplied output directory is only checked for existence; its ownership and write permissions are not validated. The ...[truncated 2744 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises operational commands that can read from and write to the local filesystem, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may execute file-affecting actions without a clearly bounded capability contract, increasing the chance of unintended backup creation, overwrite behavior, or destructive prune actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The operational notes discuss backup and prune behavior, but the skill description and command guidance do not prominently warn that running the script will create archives and that prune may delete older backups based on retention settings. In a backup-management skill, this missing warning makes destructive side effects more likely because users or agents may invoke commands without understanding that deletion is part of normal operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The spec explicitly states that backups include assistant identity and continuity files such as SOUL.md, USER.md, and AGENTS.md, which can contain sensitive instructions, secrets, operational context, or private workspace data. Because the public spec does not clearly warn users about this sensitivity or require encryption/access controls, users may create archives that expose confidential contextual data if the backup directory is shared, copied, or exfiltrated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.