ClawHub
Back to skill

Security audit

gitbackup

Security checks across malware telemetry and agentic risk

Overview

This skill creates a local Git backup as advertised, but the backup file may contain full repository history and any committed secrets until the user deletes it.

Install this only if you want local backups of the OpenClaw workspace Git repository. Treat each generated bundle like a full copy of the repo, including history and committed secrets; keep `/root/.openclaw/backups` protected and delete old bundles when they are no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill explicitly creates a Git bundle and stores it under `/root/.openclaw/backups`, which is a persistent location, but the user-facing description does not warn that repository history and refs will be written to disk. This can surprise users and may retain sensitive source code, commit history, branches, or secrets longer than expected, especially in shared or long-lived environments.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.