Security audit

Claw Backup

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly describes a backup tool, but its install and scheduler code contain review-worthy risks that could execute changing remote code or unintended commands under the user account.

Do not use the curl-to-node quick install. Clone and pin the repository first, inspect setup.js and install-launchagent.sh, prefer local-only or encrypted rclone backups, and avoid enabling the scheduler until the Bash escaping issue is fixed. On macOS, do not approve sudo removal of a system LaunchDaemon unless you intentionally want that exact service removed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:34
Finding: Mutable Remote JavaScript Is Downloaded and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: setup.js:40
Finding: Insufficient Shell Escaping Permits Command Injection in Generated Backup Script
Content: View full analysis
(typeof s === "string" ? s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') : String(s ?? "")); ``` The escaped values are then embedded inside double-quoted Bash assignments: ```javascript const p = (key, fallback) => escapeBash(toPosix(raw(key, fallback) ?? "")); const s = (key, fallback) => escapeBash(raw(key, fallback) ?? ""); const retention = String(raw("retentionDays", "7")).replace(/[^0-9]/g, "") || "7"; const uploadMode = String(raw("uploadMode", defaults.uploadMode)).trim().toLowerCase() === "local-only" ? "local-only" : "rclone"; return `#!/bin/bash set -euo pipefail PROJECT_DIR="${p("projectDir", defaults.projectDir)}" SOURCE_DIR="$PROJECT_DIR/memory" OPENCLAW_DIR="${p("openclawDir", defaults.openclawDir)}" CURSORAPPS_CLAWD="${p("cursorappsClawd", defaults.cursorappsClawd)}" LOCAL_BACKUP_DIR="${p("localBackupDir", defaults.localBackupDir)}" LOG_FILE="$LOCAL_BACKUP_DIR/backup.log" RETENTION_DAYS=${retention} RCLONE_REMOTE="${escapeBash(rcloneRemote)}" RCLONE_DEST_DIR="${escapeBash(rcloneDest)}" UPLOAD_MODE="${uploadMode}" ``` ### Technical Analysis `escapeBash()` only escapes backslashes and double quotation marks. It does not neutralize shell expansions that remain active inside double-quoted Bash strings, including: - Command substitution using `$(...)` - Legacy command substitution using backticks - Parameter expansion using `${...}` A supplied value such as `$(id > /tmp/clawbackup-injected)` remains syntactically active after generation: ```bash RCLONE_DEST_DIR="$(id > /tmp/clawbackup-injected)" ``` Bash evaluates the command substitution when the generated script initializes its var ...[truncated 1431 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: install-launchagent.sh:82
Finding: LaunchAgent Installer Performs Unnecessary Privileged Removal of a System LaunchDaemon
Content: View full analysis
/dev/null; then echo " Unloaded." fi sudo rm -f "$DAEMON_PLIST" echo " Removed $DAEMON_PLIST" echo "" fi ``` ### Technical Analysis The intended installation target is a per-user LaunchAgent under: ```text ~/Library/LaunchAgents/com.openclaw.backup.plist ``` Installing or updating that user LaunchAgent does not require root privileges. Nevertheless, the installer detects a same-named system LaunchDaemon, requests elevation through `sudo`, unloads it, and deletes its root-owned plist. The installer only checks whether the fixed path exists. It does not verify the plist’s contents, provenance, ownership beyond normal filesystem protections, executable target, or whether the system service belongs to this project. This behavior crosses the least-privilege boundary and performs a destructive migration as part of an otherwise user-level installation. The system persistence itself is not covert: scheduled backups are declared functionality, setup makes scheduling optional, and the generated LaunchAgent runs as the user. The security issue is the automatic privileged removal of an existing system service, not the documented user-level backup schedule. ### Attack Path 1. A system LaunchDaemon exists at `/Library/LaunchDaemons/com.openclaw.backup.plist`. 2. The user runs `install-launchagent.sh` to install the user-level scheduler. 3. The script detects the daemon solely from its path. 4. The script requests the user’s administrator password through `sudo`. 5. After elevation, it unloads the service and delete ...[truncated 686 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (94)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Piping curl output directly into node creates an execution chain with no inspection boundary, making accidental or malicious changes in the fetched script execute immediately. In a backup tool that may access sensitive local files and install scheduled jobs, this materially increases the blast radius of any supply-chain compromise.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
This downloads and executes setup immediately. Use only if you trust the source:

bash
curl -fsSL https://raw.githubusercontent.com/vidarbrekke/ClawBackup/main/setup.js | node

Run setup

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
## Before you install - **Do not** run `curl ... | node` (or any one-liner) without first inspecting the script. Prefer **git clone** and open `setup.js` and `install-launchagent.sh` (or the cron/Task Scheduler scripts) to review what they will do. - **Verify the code** in `setup.js` and the scheduler installer: confirm only the expected paths are archived and that there is no unexpected network use or commands. If you are uncomfortable reviewing the scripts, do not install. - **Confirm repository identity**: official source is [github.com/vidarbrekke/ClawBackup](https://github.com/vidarbrekke/ClawBackup). The version in this SKILL.md (frontmatter and "Version" line) is the source of truth; the registry may show a different revision number. - **Use encryption** for sensitive backups: an encrypted rclone remote (e.g. `rclone crypt`) or encrypt archives yourself before offsite storage.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: Piping network-fetched content directly into node is a classic dangerous command chain because it eliminates the review boundary between download and execution. In a skill that installs backup automation and scheduler entries, successful abuse could yield persistent execution and access to sensitive backup data or cloud sync configuration.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Quick install (not recommended): Only use if you have already inspected the script. Do not run without review:
bash
curl -fsSL https://raw.githubusercontent.com/vidarbrekke/ClawBackup/main/setup.js | node

Follow the prompts (or use node setup.js --defaults for default paths). Then run the printed test command and install the scheduler as shown.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · setup.js (reported line 191)May include surrounding context.
js
rsync -a --exclude='node_modules' --exclude='test-results' --exclude='.last-run.json' "$CURSORAPPS_CLAWD/" "$CLAWD_STAGE/" else cp -R "$CURSORAPPS_CLAWD"/* "$CLAWD_STAGE/" 2>/dev/null || true rm -rf "$CLAWD_STAGE/node_modules" "$CLAWD_STAGE/test-results" 2>/dev/null fi log_message "Staged Dev/CursorApps/clawd." fi

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 60)May include surrounding context.
bash
rclone config

Create a remote (e.g. googleDrive) and complete the OAuth flow.

Test a backup:
bash

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 81)May include surrounding context.
md
## Disable / uninstall scheduler - **macOS:** `launchctl unload ~/Library/LaunchAgents/com.openclaw.backup.plist` - **Linux:** remove the backup line from `crontab -e` - **Windows:** remove/disable the Task Scheduler task you created ## Restore notes (skills and user data)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 98)May include surrounding context.
md
## Disable / uninstall scheduler - **macOS:** `launchctl unload ~/Library/LaunchAgents/com.openclaw.backup.plist` - **Linux:** remove the backup line from `crontab -e` - **Windows:** remove/disable the Task Scheduler task you created ## Restore notes (skills and user data)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · setup.js (reported line 389)May include surrounding context.
js
## Disable / uninstall scheduler - **macOS:** `launchctl unload ~/Library/LaunchAgents/com.openclaw.backup.plist` - **Linux:** remove the backup line from `crontab -e` - **Windows:** remove/disable the Task Scheduler task you created ## Restore notes (skills and user data)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 97)May include surrounding context.
md
## Schedule (optional) - **macOS:** The setup generates a LaunchAgent plist. Install with the printed commands (copy to `~/Library/LaunchAgents/` and `launchctl load` — no sudo for the agent). Or run the universal installer: `./install-launchagent.sh` (it searches common locations; if your project is elsewhere, pass the plist path: `./install-launchagent.sh /path/to/com.openclaw.backup.plist`). If you had an old system-wide daemon, the installer may ask for your password once to remove it. Backup runs at the hour/minute configured during setup. - **Linux:** Add the printed cron line to `crontab -e`. - **Windows:** Use Task Scheduler to run the backup script daily via Git Bash or WSL.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 97)May include surrounding context.
md
## Schedule (optional) - **macOS:** The setup generates a LaunchAgent plist. Install with the printed commands (copy to `~/Library/LaunchAgents/` and `launchctl load` — no sudo for the agent). Or run the universal installer: `./install-launchagent.sh` (it searches common locations; if your project is elsewhere, pass the plist path: `./install-launchagent.sh /path/to/com.openclaw.backup.plist`). If you had an old system-wide daemon, the installer may ask for your password once to remove it. Backup runs at the hour/minute configured during setup. - **Linux:** Add the printed cron line to `crontab -e`. - **Windows:** Use Task Scheduler to run the backup script daily via Git Bash or WSL.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 100)May include surrounding context.
sh
## Schedule (optional) - **macOS:** The setup generates a LaunchAgent plist. Install with the printed commands (copy to `~/Library/LaunchAgents/` and `launchctl load` — no sudo for the agent). Or run the universal installer: `./install-launchagent.sh` (it searches common locations; if your project is elsewhere, pass the plist path: `./install-launchagent.sh /path/to/com.openclaw.backup.plist`). If you had an old system-wide daemon, the installer may ask for your password once to remove it. Backup runs at the hour/minute configured during setup. - **Linux:** Add the printed cron line to `crontab -e`. - **Windows:** Use Task Scheduler to run the backup script daily via Git Bash or WSL.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · setup.js (reported line 387)May include surrounding context.
js
## Schedule (optional) - **macOS:** The setup generates a LaunchAgent plist. Install with the printed commands (copy to `~/Library/LaunchAgents/` and `launchctl load` — no sudo for the agent). Or run the universal installer: `./install-launchagent.sh` (it searches common locations; if your project is elsewhere, pass the plist path: `./install-launchagent.sh /path/to/com.openclaw.backup.plist`). If you had an old system-wide daemon, the installer may ask for your password once to remove it. Backup runs at the hour/minute configured during setup. - **Linux:** Add the printed cron line to `crontab -e`. - **Windows:** Use Task Scheduler to run the backup script daily via Git Bash or WSL.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 12)May include surrounding context.
md
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 52)May include surrounding context.
md
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 80)May include surrounding context.
md
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 97)May include surrounding context.
md
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 2)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 4)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 5)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 10)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 22)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 23)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 32)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install-launchagent.sh (reported line 33)May include surrounding context.
sh
#!/usr/bin/env bash # Universal installer: probe for com.openclaw.backup.plist and existing # LaunchDaemon/LaunchAgent, then install or update the user LaunchAgent. # Usage: ./install-launchagent.sh [path-to-plist] # ./install-launchagent.sh (auto-detect plist and state)

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Chaining Abuse

Run setup

External Script Fetching

Chaining Abuse

Tool Parameter Abuse

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Static analysis