Security audit

0G ClawBack

Security checks across malware telemetry and agentic risk

Overview

This skill is a real backup/persistence tool, but it can upload broad local data and mishandles recovery keys, so users should review it carefully before installing.

Install only if you are comfortable with a skill that can package local state and send it to decentralized storage. Use a dedicated low-value wallet, avoid public upload for sensitive files, inspect exactly what will be archived before upload, and keep encryption keys in a real secret manager rather than chat, MEMORY.md, shell history, logs, or tracking databases.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill invokes commands that package workspace state, upload/download files, and handle encryption material, but the manifest declares no permissions. This under-disclosure is dangerous because users or orchestrators may authorize and invoke the skill without understanding that it can access environment-derived state and perform broad persistence actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior materially exceeds the stated purpose: it supports arbitrary file upload/download, local file restoration, and raw key handling, not just autonomous persistence of agent memories and skills. This mismatch increases the chance of unsafe invocation and social-engineering-like abuse because operators may trust a narrower description than what the skill actually enables.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The README markets the upload flow as something that will 'lock down, encrypt, and persist' files, but the documented command is explicitly a public upload flow and does not describe encryption at all. In a skill centered on backing up agent memory and state, this can mislead users into uploading sensitive state snapshots under a false expectation of confidentiality, causing unintended disclosure of secrets, prompts, credentials, or memory data.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The README claims secret files are protected using the user's public key or a wallet-derived password, but the documented download interface requires users to provide a raw encryption key directly. This inconsistency signals weak or unclear key management and may lead users to mishandle static symmetric keys, leak them via shell history or logs, or misunderstand what cryptographic guarantees the tool actually provides.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The backup instructions expand from selective agent-state persistence to freezing the active workspace into an archive, which can capture unrelated source code, secrets, tokens, and local artifacts. In this context, broad workspace backup is more dangerous because the destination is an immutable public network and mistakes are difficult to reverse.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill warns not to upload or expose private credentials, yet later instructs storing `encryptionKeyHex` in `MEMORY.md` or a tracking database. That key is itself a sensitive recovery credential, so directing it into agent memory or general logs creates a direct leakage path that could enable decryption of backed-up state.

Context-Inappropriate Capability

Medium

Confidence: 72% confidence
Finding: The directive to inspect SDK scripts, run integrity checks, and evaluate Merkle proof behavior goes beyond a simple persistence skill and broadens operational scope into software analysis and execution. Scope expansion matters here because it may justify extra command execution and environmental access not obvious from the skill's primary description.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The script uploads whatever file path is provided directly to 0G Storage via `indexer.upload(file, RPC_URL, signer)` after only checking that the file exists; there is no encryption, redaction, or access-control step before publication. This conflicts with the skill’s description of encrypted, secured persistence and creates a real risk that sensitive agent state, secrets, or local files will be irreversibly exposed on public storage.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: `uploadFile(filePath)` accepts an arbitrary user-supplied path, resolves it, verifies existence, and uploads the file without constraining it to a memory/state directory or validating file purpose. In an agent skill context, this broader capability increases the chance of accidental or induced exfiltration of unrelated local files such as configs, prompts, tokens, or host data.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script returns and prints the raw AES encryption key in JSON output, which defeats the confidentiality benefit of encrypting the uploaded file. In agent, CI, or shell environments, stdout is often captured in logs, transcripts, or orchestration state, so any party with log access can decrypt the uploaded content.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The code loads a blockchain private key from environment variables to sign uploads. While signing may be operationally required for 0G Storage, this still grants the script direct access to sensitive credentials, so compromise of the process, dependency chain, or runtime can expose a key capable of submitting transactions on behalf of the wallet.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code and comments frame the operation as 'secure' and 'locking down' the file, but the function returns the same encryption key needed to decrypt it. This is misleading and increases the likelihood that users or downstream agents will treat the output as safe to log or share, creating an avoidable secret disclosure path.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README instructs users to place a wallet private key in a .env file with no warning about secret handling, exclusion from version control, least-privilege wallet use, or host compromise risk. For a decentralized storage skill that interacts with blockchain infrastructure, normalizing unsafe private-key handling increases the chance of credential leakage and possible asset loss or unauthorized storage operations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The triggers include routine events such as modifying `MEMORY.md`, generating useful snippets, debugging scripts, or major realizations, which can cause frequent and poorly reviewed uploads. In a persistence skill, over-broad activation increases the risk of accidentally packaging sensitive transient state and sending it to external storage.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The instructions tell the operator to record the encryption key credential but do not require secure storage controls, redaction, or separation from general memory/logs. Because the key is sufficient to decrypt recovered state, informal handling materially increases confidentiality risk if logs, memory files, or databases are later exposed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script accepts an arbitrary output path from the command line, resolves it, and writes downloaded content directly with fs.writeFileSync without restricting the destination or checking for existing files. In an agent context, this enables path traversal or overwriting sensitive workspace files if an attacker can influence outputPath, which is especially risky because the skill is designed for autonomous state recovery and persistence.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The upload occurs with no explicit notice that file contents may become publicly accessible or otherwise disclosed through decentralized storage. Given the skill’s framing around agent memories and state snapshots—which commonly contain sensitive prompts, credentials, or internal state—the lack of a clear disclosure warning materially increases the risk of unsafe operator use and accidental data exposure.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The script accesses a sensitive signing credential from the environment without any user-facing warning, confirmation, or indication of which wallet/account will be used. In autonomous agent settings this reduces operator awareness and can lead to unintended signing with privileged credentials.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script uploads the contents of an arbitrary local file to a remote storage network without an explicit warning about data exfiltration or destination. In an agent memory/state-persistence context, the file may contain highly sensitive secrets, prompts, or user data, so silent transmission materially increases privacy and confidentiality risk.

Ssd 3

High

Confidence: 98% confidence
Finding: Recording the decryption key in a natural-language memory or log file creates a predictable exfiltration vector, since such files are often indexed, summarized, synced, or surfaced to models and tools. In this skill's context, that can undermine the entire encryption scheme by exposing the exact credential needed to decrypt stored backups.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # Step A: Freeze the current active workspace into a tarball container. openclaw backup create # Step B: Parse the absolute path of the generated .tar.gz from the console output. npm run upload:secret -- <PARSED_FILE_PATH>
Confidence: 81% confidence
Finding: create # Step B: Parse the absolute path of the generated .tar.gz from the console output. npm run upload:secret -- <PARSED_FILE_PATH> ``` If `openclaw backup create` is not available in the current

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: .env:1