ClawHub
Back to skill

Security audit

Dev Backup

Security checks for vulnerabilities and agentic risk

Overview

This is a local backup/restore skill, but its safety claims are inconsistent and its fallback backup path can include files it promises to exclude.

Review before installing. The skill is not showing malicious exfiltration, but it should not be treated as a safe backup tool until the embedded SKILL.md script is aligned with the runnable script and the tar fallback is fixed so exclusions are applied before the source path. Use only on non-sensitive projects or ensure rsync is present and verify backups do not contain .env or other secrets.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill documentation states that restore requires explicit user confirmation before execution, but the script performs the destructive restore immediately once invoked with --restore. In an agent setting, this mismatch is dangerous because operators may rely on the documented safety guard and unintentionally overwrite or lose project data.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The documentation says a dry-run is mandatory before restore, but the implementation allows direct destructive restore with no prerequisite state check. This can lead to accidental overwrites and deletion of newly created files because users or agents may assume the script blocks unsafe execution unless previewed first.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The tar fallback path does not apply the documented exclusion rules, so when rsync is unavailable it archives the full project tree, including files the skill says should be omitted. This can capture sensitive data such as .env files or bulky directories and undermines the advertised safety properties of the backup process.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest advertises a 'safe tar fallback', but the actual fallback behavior includes content that is supposed to be excluded from snapshots. In this context, misleading safety claims increase the risk that an agent or user will trust the backup mechanism and unknowingly store secrets or excessive data.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The tar fallback does not apply exclusions as intended because the constructed exclusion arguments are expanded incorrectly and placed after the source path, so sensitive or bulky files that rsync would skip may be included in backups. In a backup/restore skill, this increases exposure of secrets and can make restores unsafe or inconsistent with operator expectations.

Credential Access

High
Category
Privilege Escalation
Content
else
  # Fallback: tar with explicit exclusions matching rsync defaults
  EXCLUDES=""
  for excl in .git node_modules .vite .cache '*.log' .env backups; do
    EXCLUDES="$EXCLUDES --exclude $excl"
  done
  tar -C "$(dirname "$PROJECT_DIR")" -cf - \
Confidence
95% confidence
Finding
In the tar fallback path, the intended .env exclusion is likely ineffective due to incorrect argument construction and placement, so secret-bearing environment files may be archived and later restored or exposed. Because this skill is specifically for backups, accidental inclusion of credentials materially increases the danger: backups are often retained, copied, or accessed by multiple users and systems.

Static analysis

No suspicious patterns detected.