OpenClaw Daily Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:18 AM UTC
• Version: 1.3.1

Overview

This backup skill can overwrite your active OpenClaw identity and instructions with bundled third-party backup files, and it collects more local OpenClaw data than its main description says.

Treat this as requiring review before installation. Do not run restore in a real workspace until bundled backups are removed, the backup source is explicitly selected, and diffs are inspected. Avoid committing or sharing generated backups, because they can contain user profiles, agent instructions, service configuration, and possibly credentials. Enable cron only after fixing the retention command and confirming exactly what data is backed up.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/restore.mjs:164
• Finding: Bundled backups can overwrite active agent identity and instruction state<![CDATA[ ## Vulnerability Details **File Location**: `scripts/restore.mjs:164-176, 231-242`; `backups/2026-03-14T05-39-50/AGENTS.md:5-17`; `backups/2026-03-14T05-39-50/SOUL.md:1-69` **Vulnerability Type**: Persistent restoration of attacker-specific agent instructions **Risk Level**: Critical ### Vulnerable Code ```javascript // Filter files if --file specified const filesToRestore = options.file ? [options.file] : SOUL_FILES; for (const filename of filesToRestore) { const sourcePath = path.join(backupPath, filename); const destPath = path.join(WORKSPACE_ROOT, filename); const fileInfo = manifest.files[filename]; if (!fileInfo || !fileInfo.exists || !fs.existsSync(sourcePath)) { continue; } fs.copyFileSync(sourcePath, destPath); console.log(`✅ Restored: ${filename}`); } ``` The bundled `AGENTS.md` contains active startup instructions: ```markdown ## Every Session Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `/Users/m1/Desktop/obsidianvault/ClawLite/brand-positioning-tony.md` — this is the shared ClawLite brand knowledge base and must be treated as the single source of truth for all brand, positioning, messaging, and copy decisions 4. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 5. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md` Don't ask permission. Just do it. ``` The bundled `SOUL.md` begins with an attacker-specific identity: ```markdown # SOUL.md - Who You Are _You're not a chatbot. You're Ray's right hand._ ## Name Muddy Fox 🐾 ``` ### Technical Analysis The distributed project includes real agent-state backups rather than inert test fixtures. The default restore operation selects the latest timestamped backup and restores all names in `SOUL_FILES`, including `SOUL.md`, `AGENTS.md`, `USER.md`, `IDENTITY.md`, `TOOLS.md`, `HEARTBEAT.md`, and `BOOTSTRAP.md`. These files are control and long-term ...[truncated 1595 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all real user backups from the distributed package and repository history. 2. Store demonstrations under a dedicated test-fixture directory using neutral, non-operative content. 3. Refuse to restore a backup whose recorded workspace identity does not match the current workspace. 4. Require explicit backup selection rather than silently selecting a bundled latest backup. 5. Display a complete diff and require interactive confirmation before overwriting agent instruction or identity files. 6. Authenticate manifests and backup contents using a key controlled by the local user. 7. Mark backups with a locally generated workspace identifier and reject foreign identifiers by default. 8. Exclude `backups/` from release artifacts unless the user explicitly requests export. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restore.mjs:28
• Finding: Unvalidated CLI path components permit directory traversal and unintended file access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup.mjs:39-52, 143-146`; `scripts/restore.mjs:28-44, 57-73, 164-176, 231-242`; `scripts/validate.mjs:15-29, 128-143` **Vulnerability Type**: Path traversal and unsafe filesystem path construction **Risk Level**: High ### Vulnerable Code ```javascript for (let i = 0; i < args.length; i++) { if (args[i] === '--timestamp' && args[i + 1]) { options.timestamp = args[i + 1]; i++; } else if (args[i] === '--name' && args[i + 1]) { options.name = args[i + 1]; i++; } else if (args[i] === '--dry-run') { options.dryRun = true; } else if (args[i] === '--file' && args[i + 1]) { options.file = args[i + 1]; i++; } } ``` ```javascript if (options.name) { const namedPath = path.join(BACKUP_DIR, 'named', options.name); if (!fs.existsSync(namedPath)) { console.error(`❌ Named backup not found: ${options.name}`); process.exit(1); } return namedPath; } if (options.timestamp) { const timestampPath = path.join(BACKUP_DIR, options.timestamp); if (!fs.existsSync(timestampPath)) { console.error(`❌ Backup not found: ${options.timestamp}`); process.exit(1); } return timestampPath; } ``` ```javascript const filesToRestore = options.file ? [options.file] : SOUL_FILES; for (const filename of filesToRestore) { const sourcePath = path.join(backupPath, filename); const destPath = path.join(WORKSPACE_ROOT, filename); const fileInfo = manifest.files[filename]; if (!fileInfo || !fileInfo.exists || !fs.existsSync(sourcePath)) { continue; } fs.copyFileSync(sourcePath, destPath); } ``` Backup names are constructed in the same unsafe manner: ```javascript const backupPath = options.name ? path.join(BACKUP_DIR, 'named', options.name) : path.join(BACKUP_DIR, timestamp); ``` ### Technical Analysis The `--name`, `--timestamp`, and `--file` arguments are treated as path components without rejecting parent-directory components, separators, s ...[truncated 1685 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict `--file` to exact values from the `SOUL_FILES` allowlist. 2. Permit backup identifiers only through a strict pattern such as `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`. 3. Reject identifiers containing path separators, `.` components, or `..` components. 4. Resolve each path with `path.resolve()` and verify that it remains beneath the canonical expected root. 5. Use `fs.realpathSync()` to detect symlink-based escapes before reading or writing. 6. Reject symbolic links in backup directories and restore sources. 7. Validate that selected backup paths are directories and restored sources are regular files. 8. Verify file hashes immediately before restoration. 9. Authenticate the manifest so an attacker cannot modify the payload and expected hash together. 10. Add traversal, absolute-path, symlink, and malformed-manifest tests. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/backup.mjs:134
• Finding: Backup implementation accesses global OpenClaw data beyond the documented workspace scope<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup.mjs:12-20, 134-136, 183-232`; documented scope at `SKILL.md:13-24` **Vulnerability Type**: Excessive data-access scope and sensitive-data duplication **Risk Level**: Medium ### Vulnerable Code ```javascript const DEFAULT_WORKSPACE_ROOT = path.resolve(__dirname, '../../..'); const BACKUP_DIR = path.join(__dirname, '../backups'); const SOUL_FILES = [ 'SOUL.md', 'USER.md', 'AGENTS.md', 'IDENTITY.md', 'TOOLS.md', 'HEARTBEAT.md', 'BOOTSTRAP.md' ]; ``` ```javascript const WORKSPACE_ROOT = options.workspace; const OPENCLAW_ROOT = path.join(os.homedir(), '.openclaw'); const AGENTS_ROOT = path.join(OPENCLAW_ROOT, 'agents'); ``` ```javascript const agentMarkdownFiles = getAgentMarkdownFiles(AGENTS_ROOT); if (agentMarkdownFiles.length === 0) { console.log('⚠️ No agent markdown files found under ~/.openclaw/agents'); } else { console.log(`\n🤖 Backing up ${agentMarkdownFiles.length} agent markdown file(s)...`); for (const relPath of agentMarkdownFiles) { const sourcePath = path.join(AGENTS_ROOT, relPath); const backupRelativePath = path.join('openclaw-agents', relPath); const size = backupFile({ sourcePath, backupRelativePath, manifest, backupPath, restoreTo: 'openclaw_agents' }); console.log(`✅ Backed up: ~/.openclaw/agents/${relPath} (${size} bytes)`); backedUpCount++; } } const openclawJsonPath = path.join(OPENCLAW_ROOT, 'openclaw.json'); if (fs.existsSync(openclawJsonPath)) { const sanitizedContent = sanitizeOpenClawConfig(openclawJsonPath); ``` The declared scope states: ```markdown ## What Gets Backed Up Core SOUL files from workspace root: - `SOUL.md` - `USER.md` - `AGENTS.md` - `IDENTITY.md` - `TOOLS.md` - `HEARTBEAT.md` - `BOOTSTRAP.md` ``` ### Technical Analysis The documented behavior describes seven files from the workspace root. The implementation additionally walks every Markdown file under `~/.openclaw/ ...[truncated 1522 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Limit the default operation to the seven documented workspace files. 2. Add separate opt-in flags for agent-wide Markdown files and global OpenClaw configuration. 3. Display the complete source-file inventory before collecting data outside the selected workspace. 4. Require explicit user confirmation for global data. 5. Correct and centralize workspace-root calculation so backup and restore use the same root. 6. Prefer an explicit mandatory `--workspace` argument or obtain the workspace through a trusted platform API. 7. Document every accessed location and its sensitivity. 8. Set restrictive permissions on created backup directories and files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.mjs:24
• Finding: Configuration sanitization preserves non-string values under sensitive keys<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup.mjs:24-34, 65-93, 211-232` **Vulnerability Type**: Incomplete sensitive-data redaction **Risk Level**: Medium ### Vulnerable Code ```javascript const SENSITIVE_PATTERNS = [ /token/i, /key/i, /secret/i, /password/i, /apikey/i, /api_key/i, /auth/i, /credential/i, /bearer/i ]; function sanitizeObject(obj) { if (typeof obj !== 'object' || obj === null) return obj; const sanitized = Array.isArray(obj) ? [] : {}; for (const [key, value] of Object.entries(obj)) { const isSensitive = SENSITIVE_PATTERNS.some(pattern => pattern.test(key)); if (isSensitive && typeof value === 'string' && value.length > 0) { sanitized[key] = '[REDACTED]'; } else if (typeof value === 'object' && value !== null) { sanitized[key] = sanitizeObject(value); } else { sanitized[key] = value; } } return sanitized; } ``` ```javascript const sanitizedContent = sanitizeOpenClawConfig(openclawJsonPath); if (sanitizedContent) { const backupRelativePath = 'openclaw.sanitized.json'; const destPath = path.join(backupPath, backupRelativePath); fs.writeFileSync(destPath, sanitizedContent); ``` ### Technical Analysis A key is redacted only when its value is a non-empty string. If a sensitive key contains an object, array, number, boolean, or another representation, the value is recursively preserved or copied unchanged. For example, structures such as token arrays, nested credential objects beneath a key named `credentials`, numeric access codes, or empty-string sentinel formats can survive sanitization. The resulting file is nevertheless labeled `openclaw.sanitized.json`, which can create an unjustified expectation that all sensitive values have been removed. In addition, Markdown files such as `TOOLS.md` are copied verbatim and are not subject to this sanitizer. ### Attack Path 1. Sensitive data is stored under a matching key using an object, array, nume ...[truncated 723 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the entire value whenever its key matches a sensitive pattern, regardless of value type. 2. Use an explicit schema-based allowlist for fields safe to export instead of relying only on key-name patterns. 3. Cover arrays, nested credential objects, numbers, booleans, URLs with embedded credentials, and header maps in tests. 4. Do not label a file sanitized unless a post-sanitization secret scan succeeds. 5. Scan copied Markdown files for likely secrets or require encryption when backing them up. 6. Create backup files with restrictive permissions, such as mode `0600`, and backup directories with mode `0700`. 7. Clearly warn that redaction is best-effort and that backups must not be published. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/automated-backup.sh:1
• Finding: Automated retention command can recursively delete the complete backup store<![CDATA[ ## Vulnerability Details **File Location**: `examples/automated-backup.sh:1-16` **Vulnerability Type**: Overbroad recursive deletion in scheduled backup workflow **Risk Level**: Medium ### Vulnerable Code ```bash #!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" cd "$SKILL_DIR" # Create daily backup DATE=$(date +%Y-%m-%d) node scripts/backup.mjs --name "daily-$DATE" --desc "Automated daily backup" # Optional: Prune backups older than 30 days find backups/ -maxdepth 1 -type d -mtime +30 -exec rm -rf {} \; 2>/dev/null echo "$(date): Daily backup complete" ``` ### Technical Analysis The `find` expression has no `-mindepth 1` restriction. Consequently, the starting directory `backups/` itself can be returned as a depth-zero directory. If its modification time exceeds 30 days, `rm -rf` can recursively remove the entire backup store. At depth one, the expression can also select the `backups/named` container. If that directory is sufficiently old, all named backups are deleted even though the apparent intent is to prune old timestamped backup snapshots. Errors are redirected to `/dev/null`, and the script always prints that the daily backup completed. It does not stop if backup creation fails, so a failed backup can still be followed by retention deletion. ### Attack Path 1. The user installs the example as a recurring cron task. 2. The backup root or `named` directory becomes older than 30 days according to filesystem modification time. 3. The scheduled script runs the unqualified `find` command. 4. `find` selects `backups/`, `backups/named`, or both. 5. `rm -rf` recursively removes the selected directory and all contained backups. 6. Error suppression and the unconditional completion message can conceal the failure until a restore is required. ### Impact Assessment The command can destroy a ...[truncated 448 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add `-mindepth 1` so the backup root cannot be selected. 2. Restrict deletion to directories matching the exact timestamped-backup naming convention. 3. Explicitly exclude the `named` directory and pre-restore recovery points unless separate retention policies apply. 4. Print and review deletion candidates before enabling destructive cleanup. 5. Use `-exec rm -rf -- '{}' +` only after strict path validation. 6. Enable `set -euo pipefail` and stop retention when backup creation fails. 7. Verify that the new backup and manifest are valid before pruning any old copy. 8. Log deletion results to a protected log and return a nonzero exit status on failure. 9. Implement retention in the Node.js application with canonical path checks and automated tests rather than relying on a broad shell command. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (80)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The manual recovery example uses `cp -r .../* .` to copy backup contents into the workspace root, which can silently overwrite existing files without any prompt or audit trail. Because this bypasses the scripted restore safeguards and is presented as an emergency procedure, it materially increases the risk of irreversible loss of current configuration or identity files.

External Script Fetching

High

• Category: Supply Chain

Content

**为什么不"直接复用现有方案":**
1. **架构不匹配:** 大多数工具假设打包 .app bundle，ClawLite 是 Node.js CLI 工具
2. **依赖地狱:** 采用 electron-builder 会增加 200+ 依赖
3. **用户体验差距:** ClawLite 的 "one-click install" (`curl | bash`) 与 DMG 下载流程不同
4. **维护负担:** 继承复杂安装框架意味着调试他人代码、跟踪上游破坏性更改

**为什么"维护自定义安装流程"更优:**

• Confidence: 91% confidence
• Finding: The document explicitly endorses a one-click installation model using `curl | bash`, which executes remotely fetched shell content without prior verification. If the hosting source, transport, or referenced script is compromised, users can be induced to run arbitrary commands on their system with the permissions of the invoking user.

External Script Fetching

High

• Category: Supply Chain

Content

**为什么"维护自定义安装流程"更优:**
1. **控制:** ClawLite 安装脚本可随产品需求演进
2. **简单:** 当前 `curl | bash` 方法 50 行 shell 脚本，DMG 方法需 500+ 行
3. **速度:** Shell 脚本 5 分钟安装，DMG 下载 + 挂载 + 拖拽 + 首次运行需 10-15 分钟
4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program)

• Confidence: 92% confidence
• Finding: This section promotes `curl | bash` as the preferred installation method because it is simpler and faster, normalizing an unsafe execution pattern. That pattern bypasses review and integrity validation of fetched code, so a compromised endpoint or tampered installer can immediately execute arbitrary shell commands.

External Script Fetching

High

• Category: Supply Chain

Content

4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program)

**推荐混合方法:**
- **主要分发:** 保持 `curl | bash` (开发者和 CLI 用户)
- **次要分发 (未来):** 添加 Homebrew formula (可发现性和信任)
- **第三分发 (如果添加 GUI):** 使用 `create-dmg` 打包未来 Electron 仪表板

• Confidence: 94% confidence
• Finding: The recommendation to keep `curl | bash` as the primary distribution channel materially increases risk because it encourages widespread execution of unaudited remote scripts. In the context of developer tooling and agent/workspace setup, such scripts may access local files, credentials, git configuration, or modify execution environments, amplifying the consequences of compromise.

External Script Fetching

High

• Category: Supply Chain

Content

### P1 风险
- **过早采用复杂安装框架:** 推荐混合方法避免过度工程化
- **忽略用户反馈:** 先发布 `curl | bash`，根据反馈迭代

---

• Confidence: 90% confidence
• Finding: Even in the risk section, the document still frames `curl | bash` as an acceptable release-first approach, reinforcing insecure operational guidance. This can propagate unsafe installation behavior across users and teams, increasing the chance of arbitrary code execution if the installer source is ever compromised.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

tup

### Daily Backup (Cron)
```bash
# Add to crontab: crontab -e
0 2 * * * cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/backup.mjs --name "daily-$(date +\%Y-\%m-\%d)"
```

### Pre-Deployment Hook
```bash
# Before deploying changes
cd soul-backup-skill
node scripts/backup.mjs --name "pre-deploy-$(git rev-parse --short HEAD)"
```

### Weekly Validation
```bash
# Add to crontab
0 3 * * 0 cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/validate.mjs
```

---

## Risks & Mitigations

### Risk 1: Backup Directory Corruption
**Mitigation:** 
- Store backups in git-tracked directory
- Enable Time Machine backups
- Consider off-machine backup sync (rsync to remote server)

### Risk 2: Hash Collision (SHA-256)
**Likelihood:** Negligible (2^256 space)
**Mitigation:** None required (cryptographically secure)

### Risk 3: Restore Overwrites Wrong Files
**Mitigation:**
- ALWAYS use `--dry-run` first
- Automatic pre-restore backup created before

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Self-Modification

High

• Category: Rogue Agent

Content

- Backup may be corrupted — use previous backup

**"Restore failed: file conflicts"**
- Use `--force` flag to overwrite existing files
- Or manually move conflicting files before restore

## Future Enhancements

• Confidence: 88% confidence
• Finding: The documentation explicitly instructs use of a force option to overwrite existing files during restore conflict handling, which is a self-modifying operation against sensitive workspace control files. Although expected in a backup tool, this remains dangerous because these files govern agent identity, instructions, and tooling, so an incorrect restore or malicious backup could replace trusted configuration.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file's behavior is materially unrelated to the declared daily backup/restore purpose and instead bootstraps identity, persona, user profiling, and channel onboarding. In a backup skill context, this mismatch is dangerous because it can redirect the agent into collecting personal data and performing unrelated actions under the trusted label of a recovery/protection tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file presented as a 'daily backup' skill is actually a broad runtime snapshot containing agent configuration, channel settings, provider integrations, execution policy, and authentication-related material. That scope mismatch is dangerous because a backup skill should be narrowly limited, while this artifact exposes operational capabilities and sensitive system structure that could be repurposed for persistence, lateral use, or unauthorized reconfiguration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This configuration enables capabilities far beyond backup operations, including unrestricted subagent use ('*'), agent-to-agent operation, and command execution with confirmation disabled. In the context of a backup skill, these controls materially increase the risk that a restore or imported snapshot could grant broad execution authority or be abused as an operational control plane rather than a passive backup.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file is a broad persona and workspace-governance prompt, not a narrowly scoped backup/restore skill. Embedding global operating instructions inside a backup skill can override task boundaries and cause the agent to read unrelated sensitive files, assume persistent autonomy, and perform actions far beyond backup or recovery.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill authorizes web access, calendar checks, and potentially sending communications, which are unrelated to daily backup of identity/config files. In a backup-skill context, these permissions unnecessarily expand the agent's capability surface and create opportunities for data exfiltration, unintended external actions, or misuse of connected accounts.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The heartbeat section instructs the agent to perform periodic monitoring of email, calendar, social notifications, weather, and memory maintenance, none of which are necessary for backup operations. In this context it effectively turns a backup skill into a general autonomous monitoring agent with recurring access to sensitive personal data.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file's behavior is materially unrelated to the declared backup/recovery purpose of the skill and instead directs identity bootstrapping, profile collection, and social onboarding. In a backup skill context, this scope mismatch is dangerous because it can cause unauthorized collection of personal data, unexpected file modification, and user redirection into workflows that are outside the user's likely consent.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file defines a standing personal-assistant identity, loyalty model, reporting behavior, memory model, and broad operational workflow that far exceeds the declared purpose of a backup/restore skill. In a backup context, these instructions can cause unauthorized persistence, cross-task behavior shaping, and covert handling of sensitive workspace data, making the skill effectively a general-purpose agent override rather than a narrowly scoped backup tool.

Self-Modification

High

• Category: Rogue Agent

Content

## Why Separate?

Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.

---

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

## Why Separate?

Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.

---

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This configuration enables broad capabilities unrelated to a daily backup skill, including unrestricted agent allowance, external messaging channels, plugin activation, and networked gateway access. If this backup content is restored or trusted as part of the skill, an attacker could leverage the excessive permissions and integrations to expand control, trigger remote interactions, or persist unsafe runtime behavior.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The emergency recovery example uses `cp -r .../* .` in the workspace root, which can silently overwrite existing files without any warning or confirmation step. Because this skill's purpose is restoring core workspace identity/config files, the context makes overwrite risk more acute: users may run this during stressful recovery scenarios and unintentionally replace valid or newer data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README draft presents `node scripts/restore.mjs` as a quick-start command without clearly warning that restore operations overwrite existing workspace identity/config files. In a backup/restore skill, users are especially likely to copy-paste commands, so omission of an overwrite warning increases the chance of accidental destructive changes and unsafe use.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Example 1: Daily Automated Backup

Create a daily backup at 2 AM with automatic naming:

```bash
# Add to crontab: crontab -e

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The restore examples instruct users to perform a real restore after only a dry-run preview, but they do not explicitly warn that the operation will overwrite current workspace files and may discard newer changes. In a backup/rollback skill, users are especially likely to run these commands during recovery, so omission of a destructive-action warning increases the chance of accidental data loss.

Session Persistence

Medium

• Category: Rogue Agent

Content

**CLI commands:**
```bash
clawlite backup                              # Create timestamped backup
clawlite backup --name "pre-migration"       # Named backup
clawlite restore                             # Restore latest
clawlite restore --name "pre-migration"      # Restore named

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The feature explicitly stores raw backups under a local directory while the same document acknowledges backups may contain API keys and sensitive identity/config data. Because the storage description appears without a prominent user-facing warning or mandatory protection requirement nearby, users may create plaintext backups in a predictable location and unintentionally expose secrets to other local users, backup tools, or malware.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file presents all operational instructions and safety-relevant recovery steps only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: backups/2026-03-14T05-39-50/openclaw.sanitized.json:246