Security audit

Full Backup

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a local full backup for a clear purpose, but it delegates the real work to an external script outside the reviewed package and may capture sensitive workspace or configuration data without much user-facing control.

Install only if you trust the existing /root/.openclaw/workspace/scripts/backup-local.sh script and the local machine permissions around it. Before running, confirm the backup scope, destination, permissions, and secret-handling policy, because this may archive sensitive workspace and configuration data into durable local files.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/full-backup.sh:4
Finding: Unverified External Backup Script Can Be Hijacked
Content: View full analysis
&2 exit 1 fi "$BACKUP_SCRIPT" ``` ### Technical Analysis The bundled wrapper delegates all backup behavior to `/root/.openclaw/workspace/scripts/backup-local.sh`, which is located outside the audited Skill package. The only validation performed is the `-x` test, which confirms that the path resolves to an executable object. It does not verify: - The file's owner or group. - Whether the file or its parent directories are writable by untrusted users. - Whether the path resolves through a symbolic link. - The executable's cryptographic integrity. - Whether the target is a regular file. - Whether its behavior matches the backup safeguards claimed in `SKILL.md`. As a result, the effective behavior of this Skill can change independently of the reviewed package. If an attacker can replace the external script or redirect its path, invoking the legitimate-looking backup Skill will execute attacker-controlled commands. ### Attack Path 1. An attacker obtains write access to `/root/.openclaw/workspace/scripts/backup-local.sh` or a relevant parent directory through a separate permission weakness, compromised deployment process, or account access. 2. The attacker replaces the script or redirects the path using a symbolic link to an attacker-controlled executable. 3. The replacement is marked executable so that the `-x` check succeeds. 4. A user or Agent invokes the full-backup Skill. 5. `scripts/full-backup.sh` executes the substituted payload without ownership or integrity verification. 6. The payload runs with the same operating-system privileges and access available to the Skill proc ...[truncated 637 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill manifest is broadly worded and does not narrowly constrain when the backup action should be invoked. Because this action can create a full local backup of workspace and configuration data, an overly permissive trigger increases the chance of unintended activation, causing sensitive data collection or filesystem changes without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest advertises creation of a full local backup archive without warning about the sensitivity of backed-up data or the potentially significant filesystem effects, such as large archive creation and inclusion of configuration secrets. In context, this makes the skill more dangerous because backups commonly capture credentials, tokens, and private workspace contents, and the prompt directs execution without any caution or confirmation step.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.