Security audit

Simple Backup

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real encrypted backup skill, but it handles very sensitive local data and passwords with implementation and install risks that require manual review before installation.

Review or fix this skill before installing. At minimum, remove or pin the unnecessary npm dependencies, validate retention settings as decimal integers, pass the GPG password through a safer channel such as a file descriptor or agent, add cleanup traps and restrictive permissions for temporary files, and confirm exactly what state, credentials, and rclone destination will be included.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: simple-backup.sh:57
Finding: Command Execution Through Unvalidated Arithmetic Configuration
Content: View full analysis
/dev/null || true ``` ### Technical Analysis `HOURLY_RETENTION_HOURS` is read from the OpenClaw configuration or the process environment without being constrained to a decimal integer. It is subsequently evaluated inside a Bash arithmetic expansion. Bash arithmetic expressions may recursively interpret variable contents as arithmetic syntax. Specially constructed expressions, including expressions involving array subscripts and command substitutions, can cause unintended shell commands to be evaluated. Quoting ordinary shell arguments does not protect a value once it is interpreted as arithmetic syntax. `MAX_DAYS` is also supplied directly to `find` without numeric validation. Although it is not used in arithmetic expansion, malformed or option-like input could disrupt pruning behavior. Both retention settings should be strictly validated. ### Attack Path 1. An attacker obtains the ability to set `HOURLY_RETENTION_HOURS` in the backup process environment or modify the `hourlyRetentionHours` value in `~/.openclaw/openclaw.json`. 2. The attacker supplies a malicious Bash arithmetic expression rather than an integer. 3. A user or automated process runs `simple-backup`. 4. The script completes staging and encryption and reaches hourly backup pruning. 5. Bash evaluates the attacker-controlled value in `$(( ...[truncated 679 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: simple-backup.sh:96
Finding: Plaintext Backup Data Remains on Disk After Failure or Interruption
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: simple-backup.sh:72
Finding: Backup Encryption Password Exposed in Process Arguments
Content: View full analysis
Remediation: View remediation
/dev/null)" != "600" ]; then echo "Error: Backup key must be accessible only to its owner." exit 1 fi ``` - Clear the shell variable after encryption: ```bash unset BACKUP_PASSWORD ``` - Use a unique, high-entropy password that is not reused elsewhere. - Ensure diagnostic logging and tracing are disabled around secret handling. ]]>

T08 · Insecure Dependencies

Warning

Location: package.json:12
Finding: Unnecessary and Unpinned npm Dependencies Expand Supply-Chain Exposure
Content: View full analysis
/dev/null; then echo "Error: $cmd is not installed." exit 1 fi done ``` The setup documentation also instructs users to install rclone and GnuPG as system packages. Consequently, the npm dependencies do not appear necessary for the declared implementation. Using `"*"` permits npm to select any version available at installation time. This makes installations non-reproducible and exposes users to future compromised, malicious, or incompatible releases without a source change in this project. npm dependency installation can also execute package lifecycle scripts, increasing the impact of a compromised dependency. ### Attack Path 1. A user installs or updates the `simple-backup` npm package. 2. npm resolves the latest available versions matching `"*"`. 3. One of the named packages or its transitive dependencies has been compromised, has introduced unsafe lifecycle behavior, or publishes an incompatible release. 4. npm downloads and installs that version even though it was never reviewed with this Skill. 5. Malicious lifecycle code may execute during installation with the installing user's privileges, or installed package behavior may affect the environment. This path depends on a malicious or compromised dependency release; the audit did not establish that the current upstream packages are malicious. ### Impact Assessment A compromised npm dependency could execute code w ...[truncated 447 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill metadata and description understate the full behavior: it also backs up the skills directory, handles encryption/password sourcing, and prunes backups. For a backup skill, these behaviors are plausible, but failing to disclose them can cause users to expose additional sensitive data or permit destructive retention actions without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation describes backup features but does not clearly warn that the skill writes archives locally, may delete older backups, and may sync potentially sensitive workspace/state data to a cloud remote. In the context of an agent backup tool, these are high-sensitivity operations, so omission of explicit warnings increases the risk of accidental data exposure or unintended data loss.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Using an unconstrained version specifier for rclone allows whatever version is current at install time to be pulled in, which makes builds non-reproducible and increases supply-chain risk. If a malicious, compromised, or breaking release is published, a backup tool with filesystem and cloud-sync access could ingest that version and expose sensitive backed-up data or execute unintended behavior.
Content: Scanner excerpt · package.json (reported line 15)May include surrounding context.
json
"SKILL.md" ], "dependencies": { "rclone": "*", "gpg": "*" } }

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Using an unconstrained version specifier for gpg permits any published version to be installed, increasing the risk of supply-chain compromise and unpredictable behavior in a security-sensitive encryption path. Because this skill advertises secure encrypted backups, a compromised or incompatible dependency could directly weaken confidentiality or reliability of backup creation and restoration.
Content: Scanner excerpt · package.json (reported line 16)May include surrounding context.
json
], "dependencies": { "rclone": "*", "gpg": "*" } }

Static analysis

No suspicious patterns detected.