T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ctm.sh:361- Finding
Remote Command Injection Through the --remote-dir Argument
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Time Machine
Security checks for vulnerabilities and agentic risk
Overview
This is a real OpenClaw backup and migration tool, but it handles credentials and remote restore commands in ways that need careful review before use.
Install only if you trust the publisher and need full OpenClaw state backup or migration. Treat every backup as a sensitive secrets bundle, store it privately, do not restore archives from untrusted sources, avoid --force unless automation is intentional, do not use untrusted --remote-dir values, and prefer fixing the remote-script quoting, archive validation, and file-permission controls before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ctm.sh:183- Finding
Sensitive Backup Archives Are Created Without Enforced Private Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ctm.sh:264- Finding
Restore Extracts Untrusted Archives Without Content or Authenticity Validation
- Content
View full analysis
/dev/null confirm_or_exit "这会覆盖当前 OpenClaw 保留状态路径" mkdir -p "$OPENCLAW_DIR" create_safety_backup log_info "清理现有保留状态..." remove_soul_items log_info "从备份恢复: $full_path" tar xzf "$full_path" -C "$OPENCLAW_DIR" ``` The remote migration script repeats the same extraction pattern: ```bash mkdir -p "$REMOTE_DIR" tar tzf "$ARCHIVE" >/dev/null if ! confirm_or_exit "Remote restore will overwrite preserved state in $REMOTE_DIR"; then echo "Cancelled" exit 1 fi if [ -d "$REMOTE_DIR" ]; then mkdir -p "$SAFETY_DIR" for item in $SOUL_ITEMS; do if [ -e "$REMOTE_DIR/$item" ]; then mkdir -p "$SAFETY_DIR/$(dirname "$item")" cp -a "$REMOTE_DIR/$item" "$SAFETY_DIR/$item" fi done fi for item in $SOUL_ITEMS; do if [ -e "$REMOTE_DIR/$item" ]; then rm -rf -- "$REMOTE_DIR/$item" fi done tar xzf "$ARCHIVE" -C "$REMOTE_DIR" ``` ### Technical Analysis `tar tzf` only confirms that the input can be parsed as a gzip-compressed tar archive. It does not establish that the archive: - Was produced by this Skill. - Has not been altered. - Contains only the documented top-level paths. - Contains safe member names and file types. - Matches a trusted or signed manifest. - Excludes malicious skills, scheduled-task state, symbolic links, hard links, device entries, or other unexpected content. After this minimal format check, the script deletes the existing preserved state and extracts every archive member d ...[truncated 2287 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh local item for item in "${SOUL_FILES[@]}"; do if [[ -e "$OPENCLAW_DIR/$item" ]]; then rm -rf -- "$OPENCLAW_DIR/$item" fi done }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The remote restore script performs rm -rf on paths derived from the user-controlled --remote-dir value after simple string substitution into a shell script. If REMOTE_DIR is set to a dangerous location such as /, $HOME, or a path containing shell metacharacters, the generated remote script can delete unintended files or execute injected commands on the remote host during migration.
- Content
sh for item in $SOUL_ITEMS; do if [ -e "$REMOTE_DIR/$item" ]; then rm -rf -- "$REMOTE_DIR/$item" fi done
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation description is broad enough to trigger on very common terms like backup, restore, migration, and generic Chinese equivalents. That can cause the skill to activate in contexts where the user did not intend to invoke a highly privileged state-management tool, increasing the chance of destructive restore or data-exfiltrating migration actions being suggested or run.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The skill is explicitly designed to persist and archive sensitive session and installation state, including credentials, identity, workspace memories, and custom skills, into backups under a user directory and to migrate them to remote hosts. This materially increases exposure of secrets at rest and in transit, especially if backup permissions, encryption, retention, or destination trust are not tightly controlled.
- Content
md Commands: - `backup [filename]` — create a backup under `~/.ctm/` - `list` — show backups, newest first - `restore <index|filename|latest> [--force]` — restore a backup - `migrate <user@host> [--remote-dir <dir>] [--clean-remote-archive] [--force]` — copy a backup to another machine and restore it there
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md High-level sequence: 1. Create a fresh backup on the source machine 2. Copy the archive to the target machine 3. Ensure `~/.openclaw` exists on the target machine 4. Create a safety backup of target state paths if they exist
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The script is explicitly designed to back up and migrate highly sensitive state, including credentials, identity, workspace memory, skills, and scheduled tasks. In this skill context, preserving and exporting that material increases risk because the resulting tar.gz archives are not encrypted, are copied to a predictable backup directory, and are transferred to remote hosts, creating a concentrated secrets bundle that could be stolen or misused if local or remote storage is compromised.
- Content
sh $SCRIPT_NAME migrate <user@host> [--remote-dir <dir>] [--clean-remote-archive] [--force] Commands: backup Create a backup in $BACKUP_DIR list List backups, newest first restore Restore by index, filename, or 'latest' migrate Create a fresh backup, copy it to a remote host, and restore there
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This shell script includes user-facing operational messages in Chinese, such as dependency and error output, without any indication that language is configurable or selected by user preference. That can violate a language/locale policy when a skill is expected to respect user locale or offer opt-in.
- Content