T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Unpinned Third-Party Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Auto Backup
Security checks for vulnerabilities and agentic risk
Overview
This backup skill is not clearly malicious, but it needs Review because it can copy sensitive OpenClaw state in plaintext and restore or delete local files while its permissions and path scoping are under-disclosed and buggy.
Review carefully before installing. This skill is local-only in the reviewed scripts and I found no network upload, prompt hijacking, or intentional exfiltration, but it handles sensitive OpenClaw state in plaintext and can overwrite or delete local files. Use only after pinning the installed version, fixing path expansion and restore layout, constraining backupDir/watchFiles to intended OpenClaw paths, and treating cleanup/restore as destructive operations that need confirmation and a fresh backup.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
config/backup-config.json:3- Finding
Configured Home-Directory Paths Are Not Expanded
- Content
View full analysis
- Remediation
View remediation
Path: return Path(value).expanduser().resolve() ``` - Apply the same normalization to `backupDir` and every `watchFiles` entry. - Use one shared configuration and path-resolution module in backup, list, cleanup, and restore. - Reject relative paths where configuration is expected to identify a trusted absolute location. - Verify that the resolved backup directory remains beneath an explicitly approved root. - Add integration tests that execute the scripts from arbitrary working directories and under a cron-like environment. - Fail with a nonzero exit status when configured source files cannot be found, rather than silently appearing successful. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.py:101- Finding
Nested Symbolic Links Are Followed During Directory Backup
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/restore.py:157- Finding
Backup Archive Layout and Restore Destination Mapping Are Incompatible
- Content
View full analysis
/manifest.json ``` The manifest actually resides beneath the timestamped top-level directory, so restoration terminates before copying files. There is a second mapping error. Backup records paths relative to `OPENCLAW_HOME`, producing values such as `workspace/MEMORY.md`. Restore prefixes those paths with `WORKSPACE`, yielding: ```text ~/.openclaw/workspace/workspace/M ...[truncated 1363 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (24)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 方法 1: 在 config/backup-config.json 中排除敏感文件 { "excludePatterns": ["*.env", "*.key", "secrets/*"] } # 方法 2: 使用外部加密
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
The script accepts backupDir from a JSON config and then allows recursive deletion of matching backup-* files/directories without canonical-path validation or confinement to an expected base directory. Combined with --no-confirm, a tampered config can turn this into unattended destructive deletion of attacker-chosen paths, especially in cron or agent-driven contexts where no human reviews the target first.
- Content
python parser.add_argument('--keep', type=int, help='保留最近 N 个备份') parser.add_argument('--older-than', type=str, help='删除超过指定天数的备份 (如：30d)') parser.add_argument('--dry-run', action='store_true', help='仅显示，不实际删除') parser.add_argument('--no-confirm', action='store_true', help='跳过确认') args = parser.parse_args() print_header("🧹 清理备份")
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file documents
restore.pyandcleanup.py, including commands that restore configurations and delete old backups, but it does not explicitly warn users about the potential for overwriting current configuration state or permanently removing backup files. Because these behaviors can affect user data and system integrity, the README should disclose them clearly.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README documents restore commands that can overwrite active configuration files but does not warn users about that destructive side effect or recommend verifying the target version first. In a backup/restore skill, omission of overwrite warnings increases the chance of accidental data loss or rollback to an unsafe state, especially when users may run commands verbatim from the documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The cleanup examples describe deletion operations without clearly warning that backups may be permanently removed. Because this skill is specifically for backup retention and recovery, undocumented destructive cleanup behavior can mislead users into deleting recoverable versions they may later need, resulting in irreversible loss of backup data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents file read/write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege problem: an installer or host may not clearly understand that the skill can modify local files, including backups and restores under ~/.openclaw, increasing the chance of overbroad execution in a sensitive filesystem context.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The installation instructions reference 'npx clawhub' without pinning a specific version. Unpinned package execution can introduce supply-chain risk because future package updates, dependency compromise, or registry hijacking could cause different code to run than what was originally reviewed.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The skill encourages configuring a persistent scheduled task via system crontab, which establishes long-lived execution on the host. Persistence is not inherently malicious in a backup skill, but it is security-relevant because recurring unattended execution can amplify the impact of bugs, path mistakes, or later script tampering.
- Content
系统 Crontab（可选）
如需使用系统 cron：
bash crontab -e # 添加：0 2 * * * cd ~/.openclaw/workspace/skills/auto-backup && python3 scripts/backup.py --note 定时备份
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation says only read access to ~/.openclaw/ is required, but the described operations create archives, restore files, and clean up backups, all of which require write access. Misstating required privileges can mislead reviewers and users, causing unsafe approvals or execution under broader access than expected.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
权限设置
bash # 设置备份目录权限（推荐） chmod 700 ~/.openclaw/backups # 不要以 root 身份运行 # 以普通用户身份运行备份
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This configuration enables automatic backups of multiple potentially sensitive workspace and identity files while explicitly disabling encryption. Although there is a note stating encryption is unsupported, the warning is not user-facing in any enforceable way and the backups are directed to local storage by default, which can expose secrets, session state, and personal data if the host is compromised or backups are shared.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The backup logic accepts config-supplied glob patterns and plain paths, then copies any matching file or directory from the local filesystem. Although the code skips top-level symlinks, it does not restrict sources to OpenClaw-owned configuration paths, so a modified or overly broad config can collect unrelated sensitive files such as SSH keys, shell history, or other application secrets into backup archives.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script fully trusts backupDir and watchFiles from the JSON config, enabling config-driven collection of arbitrary files and directories and placement of backups in arbitrary writable locations. In the context of a configuration-backup skill, this is broader than necessary and increases the blast radius if the config is tampered with, because the skill can exfiltration-stage or persist copies of sensitive local data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code presents warnings, prompts, and argument descriptions in Chinese only, including the destructive-deletion confirmation flow. The policy requires avoiding forced language or locale behavior unless the user is given a choice or the constraint is clearly documented and justified.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 65% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python parser.add_argument('--keep', type=int, help='保留最近 N 个备份') parser.add_argument('--older-than', type=str, help='删除超过指定天数的备份 (如：30d)') parser.add_argument('--dry-run', action='store_true', help='仅显示，不实际删除') parser.add_argument('--no-confirm', action='store_true', help='跳过确认') args = parser.parse_args() print_header("🧹 清理备份")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains multiple user-facing strings in Chinese, including the header, status messages, and usage hints. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The main README content is written in Chinese, while English is relegated to a separate linked document rather than offering language choice inline. This can be interpreted as a language/locale policy issue if users are expected to consume the skill documentation in a specific language without explicit opt-in.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest-level description emphasizes a fully self-contained local backup skill with '无网络' and '无外部依赖'. However, the same file advertises an external GitHub repository, which weakens the claimed self-contained/local-only framing of the skill package. This is a mild description mismatch because the documented operational scope is local-only while the distribution/source story includes an external dependency surface.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language note at L28 is written only in Chinese and does not indicate any language-selection or localization mechanism. This can violate language/locale policy when users are not explicitly opted into that locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The usage text and operational note are presented only in Chinese, and the rest of the script continues this pattern for user-visible output. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can exclude users who do not read that language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The top-level docstring presents core usage and security information in Chinese, including the restore description and security note, without indicating any language option or locale-specific justification. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.
- Content
Static analysis
No suspicious patterns detected.