ClawHub
Back to skill

Security audit

Full Backup

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a local full backup for a clear purpose, but it delegates the real work to an external script outside the reviewed package and may capture sensitive workspace or configuration data without much user-facing control.

Install only if you trust the existing /root/.openclaw/workspace/scripts/backup-local.sh script and the local machine permissions around it. Before running, confirm the backup scope, destination, permissions, and secret-handling policy, because this may archive sensitive workspace and configuration data into durable local files.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/full-backup.sh:4
Finding
Unverified External Backup Script Can Be Hijacked<![CDATA[ ## Vulnerability Details **File Location**: `scripts/full-backup.sh`, lines 4–11 **Vulnerability Type**: Untrusted external executable invocation **Risk Level**: Medium ### Vulnerable Code ```bash BACKUP_SCRIPT="/root/.openclaw/workspace/scripts/backup-local.sh" if [ ! -x "$BACKUP_SCRIPT" ]; then echo "Error: backup script not found or not executable: $BACKUP_SCRIPT" >&2 exit 1 fi "$BACKUP_SCRIPT" ``` ### Technical Analysis The bundled wrapper delegates all backup behavior to `/root/.openclaw/workspace/scripts/backup-local.sh`, which is located outside the audited Skill package. The only validation performed is the `-x` test, which confirms that the path resolves to an executable object. It does not verify: - The file's owner or group. - Whether the file or its parent directories are writable by untrusted users. - Whether the path resolves through a symbolic link. - The executable's cryptographic integrity. - Whether the target is a regular file. - Whether its behavior matches the backup safeguards claimed in `SKILL.md`. As a result, the effective behavior of this Skill can change independently of the reviewed package. If an attacker can replace the external script or redirect its path, invoking the legitimate-looking backup Skill will execute attacker-controlled commands. ### Attack Path 1. An attacker obtains write access to `/root/.openclaw/workspace/scripts/backup-local.sh` or a relevant parent directory through a separate permission weakness, compromised deployment process, or account access. 2. The attacker replaces the script or redirects the path using a symbolic link to an attacker-controlled executable. 3. The replacement is marked executable so that the `-x` check succeeds. 4. A user or Agent invokes the full-backup Skill. 5. `scripts/full-backup.sh` executes the substituted payload without ownership or integrity verification. 6. The payload runs with the same operating-system privileges and access available to the Skill proc ...[truncated 637 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Bundle the backup implementation inside the reviewed Skill package so its behavior is versioned and audited with the wrapper. 2. If an external executable is required, validate it before execution: - Require a regular file and reject symbolic links. - Verify trusted ownership and restrictive permissions. - Confirm that the script and all parent directories are not writable by untrusted users. - Validate the file against a pinned cryptographic digest or signed manifest. 3. Execute the backup process under a dedicated, least-privileged account with access limited to the required source and destination paths. 4. Ensure backup archives are created with restrictive permissions and that sensitive files are explicitly included or excluded according to a reviewed policy. 5. Fail closed if any ownership, permission, file-type, path, or integrity check does not match the expected configuration. 6. Update `SKILL.md` so claims about archive location and safe exclusions are either enforced by packaged code or clearly documented as properties of a separately trusted dependency. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill manifest is broadly worded and does not narrowly constrain when the backup action should be invoked. Because this action can create a full local backup of workspace and configuration data, an overly permissive trigger increases the chance of unintended activation, causing sensitive data collection or filesystem changes without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The manifest advertises creation of a full local backup archive without warning about the sensitivity of backed-up data or the potentially significant filesystem effects, such as large archive creation and inclusion of configuration secrets. In context, this makes the skill more dangerous because backups commonly capture credentials, tokens, and private workspace contents, and the prompt directs execution without any caution or confirmation step.

Static analysis

No suspicious patterns detected.