openclaw-backup-yyc

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 1.0.0

Overview

This is a real OpenClaw backup and restore tool, but it has enough under-disclosed network and restore authority that users should review it before installing.

Install only if you are comfortable with a local script that reads and rewrites OpenClaw data. Review the scripts first, avoid running them as root, unset OPENCLAW_DIR unless you intentionally use a custom OpenClaw directory, and restore only archives you personally trust. Be aware that backup.py contacts public-IP services to generate an SCP command example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

server_ip = "服务器IP"
    for service in ip_services:
        try:
            result = subprocess.run(['curl', '-s', '--connect-timeout', '3', service], capture_output=True, text=True)
            if result.returncode == 0 and result.stdout.strip():
                server_ip = result.stdout.strip()
                break

• Confidence: 93% confidence
• Finding: The script spawns an external curl process to contact third-party IP lookup services during a backup operation, which is not required for creating a local archive. This adds unnecessary command execution and outbound network behavior, increasing attack surface and creating privacy/integrity risks if a service returns unexpected content or if curl is unavailable/aliased in the execution environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises no declared permissions, yet its documented behavior and referenced commands imply shell execution, filesystem writes, and environment access. This is dangerous because it hides sensitive capabilities from the permission model and reviewers, increasing the risk of unauthorized file modification, archive creation/restoration, and access to host-level data under ~/.openclaw/.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior does not match the analyzed behavior: backup/restore can occur without the mandatory confirmation described, restore confirmation is optional, backup listing is undeclared, and the implementation may contact external services to determine public IP and generate SCP download commands. Mismatches like this undermine user consent and informed review, and external network access may leak infrastructure metadata while backup artifacts may expose sensitive data paths.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The backup utility goes beyond archiving data and performs external IP discovery to generate SCP instructions, which is outside the declared backup/restore scope. In an agent skill context, undeclared network access is especially risky because users invoking a backup do not reasonably expect the tool to contact third-party services and disclose server metadata.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code invokes subprocesses and makes outbound requests to multiple external services solely to determine the host's public IP, an unjustified capability for a backup tool. In a security-sensitive agent environment, unnecessary subprocess and network capabilities materially increase exposure to data leakage, dependency abuse, and unexpected side effects beyond the user’s requested action.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The tool claims it only backs up the default ~/.openclaw directory, but it will instead use any OPENCLAW_DIR environment variable that exists. This mismatch can cause users to back up or disclose a different directory than expected, which is particularly problematic for an agent skill where environment-controlled behavior may be opaque to the user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script contacts third-party IP lookup services without warning in its main usage/help text, exposing network metadata during an operation the user believes is local backup. Hidden outbound communication violates the principle of least surprise and is more dangerous in a skill because users may authorize backup but not external disclosure of host information.

Static analysis

No suspicious patterns detected.