ClawHub
Back to skill

Security audit

OpenClaw备份回滚系统

Security checks for vulnerabilities and agentic risk

Overview

This backup-and-rollback skill matches its stated purpose, but it can overwrite OpenClaw state and interrupt services with weak safeguards.

Review before installing. Use this only if you are comfortable with frequent local backups of ~/.openclaw and rollback commands that can overwrite current configuration and interrupt OpenClaw services. Protect the backup directory, verify backups before restore, and test on non-critical data first.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(["systemctl", "--user", "stop", svc], capture_output=True)
    
    # 解压还原
    result = subprocess.run(
        ["tar", "-xzf", str(backup_file), "-C", str(OPENCLAW_DIR.parent)],
        capture_output=True, text=True
    )
Confidence
88% confidence
Finding
Restoring by extracting a tar archive into the application parent directory is dangerous because archive contents are not validated before extraction. A malicious or tampered backup can overwrite arbitrary files within the extraction scope, introduce symlinks, or restore unsafe content, turning rollback into a code or configuration replacement mechanism.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 解压还原
    print("🔄 还原到备份...")
    result = subprocess.run(
        ["tar", "-xzf", str(backup_file), "-C", str(openclaw_dir.parent)],
        capture_output=True, text=True
    )
Confidence
94% confidence
Finding
Extracting a tar archive directly into the parent of ~/.openclaw without validating archive entries is dangerous because a malicious backup can contain path traversal entries, symlinks, or overwrite files outside the intended restore directory. In a rollback tool, backups may be assumed trusted, but if an attacker can place or tamper with a backup file, this becomes arbitrary file overwrite within the user's permissions.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
with tempfile.TemporaryDirectory() as tmpdir:
        # 解压备份到临时目录
        subprocess.run(["tar", "-xzf", str(backup_file), "-C", tmpdir], capture_output=True)
        backup_extract = Path(tmpdir) / ".openclaw"
        
        # 对比关键配置文件
Confidence
92% confidence
Finding
The diff routine extracts the chosen tarball into a temporary directory using tar without validating archive contents. Although extraction occurs in a temp location, malicious paths or links in the archive can still escape the temp directory or target unexpected files depending on tar behavior and archive structure, making this unsafe for untrusted backups.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The restore function documentation states that it restores a backup, but the implementation also stops and restarts services as side effects. Hidden disruptive behavior increases the chance of accidental downtime and unsafe invocation by callers who do not expect service manipulation during restore.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation describes rollback as extracting a backup over the current configuration and restarting the Gateway, but it does not clearly warn users that the operation is destructive and service-impacting. This omission can lead operators to trigger rollback without understanding that current state will be overwritten and the running service will be interrupted, increasing the chance of accidental outage or loss of recent configuration changes.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises automatic full-directory backups of the `.openclaw` directory every 15 minutes but does not disclose the data scope or privacy implications. Full configuration directories commonly contain secrets, tokens, logs, and other sensitive operational data, so undocumented automated collection and retention can expose users to confidentiality and compliance risks if backups are accessed, copied, or mishandled.

Missing User Warnings

High
Confidence
94% confidence
Finding
The restore path performs a destructive rollback and service interruption immediately, with no confirmation, dry-run, or explicit safeguard. In an agent skill context, this is especially risky because a mistaken or coerced invocation can overwrite current state and cause avoidable downtime without a human checkpoint.

Static analysis

No suspicious patterns detected.