T01 · Skill Instruction Hijacking
Error
- Location
scripts/restore.mjs:164- Finding
Bundled backups can overwrite active agent identity and instruction state
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Daily Backup
Security checks for vulnerabilities and agentic risk
Overview
This backup skill can overwrite your active OpenClaw identity and instructions with bundled third-party backup files, and it collects more local OpenClaw data than its main description says.
Treat this as requiring review before installation. Do not run restore in a real workspace until bundled backups are removed, the backup source is explicitly selected, and diffs are inspected. Avoid committing or sharing generated backups, because they can contain user profiles, agent instructions, service configuration, and possibly credentials. Enable cron only after fixing the retention command and confirming exactly what data is backed up.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/restore.mjs:28- Finding
Unvalidated CLI path components permit directory traversal and unintended file access
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/backup.mjs:134- Finding
Backup implementation accesses global OpenClaw data beyond the documented workspace scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.mjs:24- Finding
Configuration sanitization preserves non-string values under sensitive keys
- Content
View full analysis
pattern.test(key)); if (isSensitive && typeof value === 'string' && value.length > 0) { sanitized[key] = '[REDACTED]'; } else if (typeof value === 'object' && value !== null) { sanitized[key] = sanitizeObject(value); } else { sanitized[key] = value; } } return sanitized; } ``` ```javascript const sanitizedContent = sanitizeOpenClawConfig(openclawJsonPath); if (sanitizedContent) { const backupRelativePath = 'openclaw.sanitized.json'; const destPath = path.join(backupPath, backupRelativePath); fs.writeFileSync(destPath, sanitizedContent); ``` ### Technical Analysis A key is redacted only when its value is a non-empty string. If a sensitive key contains an object, array, number, boolean, or another representation, the value is recursively preserved or copied unchanged. For example, structures such as token arrays, nested credential objects beneath a key named `credentials`, numeric access codes, or empty-string sentinel formats can survive sanitization. The resulting file is nevertheless labeled `openclaw.sanitized.json`, which can create an unjustified expectation that all sensitive values have been removed. In addition, Markdown files such as `TOOLS.md` are copied verbatim and are not subject to this sanitizer. ### Attack Path 1. Sensitive data is stored under a matching key using an object, array, nume ...[truncated 723 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/automated-backup.sh:1- Finding
Automated retention command can recursively delete the complete backup store
- Content
View full analysis
> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" cd "$SKILL_DIR" # Create daily backup DATE=$(date +%Y-%m-%d) node scripts/backup.mjs --name "daily-$DATE" --desc "Automated daily backup" # Optional: Prune backups older than 30 days find backups/ -maxdepth 1 -type d -mtime +30 -exec rm -rf {} \; 2>/dev/null echo "$(date): Daily backup complete" ``` ### Technical Analysis The `find` expression has no `-mindepth 1` restriction. Consequently, the starting directory `backups/` itself can be returned as a depth-zero directory. If its modification time exceeds 30 days, `rm -rf` can recursively remove the entire backup store. At depth one, the expression can also select the `backups/named` container. If that directory is sufficiently old, all named backups are deleted even though the apparent intent is to prune old timestamped backup snapshots. Errors are redirected to `/dev/null`, and the script always prints that the daily backup completed. It does not stop if backup creation fails, so a failed backup can still be followed by retention deletion. ### Attack Path 1. The user installs the example as a recurring cron task. 2. The backup root or `named` directory becomes older than 30 days according to filesystem modification time. 3. The scheduled script runs the unqualified `find` command. 4. `find` selects `backups/`, `backups/named`, or both. 5. `rm -rf` recursively removes the selected directory and all contained backups. 6. Error suppression and the unconditional completion message can conceal the failure until a restore is required. ### Impact Assessment The command can destroy a ...[truncated 448 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (80)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manual recovery example uses
cp -r .../* .to copy backup contents into the workspace root, which can silently overwrite existing files without any prompt or audit trail. Because this bypasses the scripted restore safeguards and is presented as an emergency procedure, it materially increases the risk of irreversible loss of current configuration or identity files.- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The document explicitly endorses a one-click installation model using
curl | bash, which executes remotely fetched shell content without prior verification. If the hosting source, transport, or referenced script is compromised, users can be induced to run arbitrary commands on their system with the permissions of the invoking user.- Content
md **为什么不"直接复用现有方案":** 1. **架构不匹配:** 大多数工具假设打包 .app bundle，ClawLite 是 Node.js CLI 工具 2. **依赖地狱:** 采用 electron-builder 会增加 200+ 依赖 3. **用户体验差距:** ClawLite 的 "one-click install" (`curl | bash`) 与 DMG 下载流程不同 4. **维护负担:** 继承复杂安装框架意味着调试他人代码、跟踪上游破坏性更改 **为什么"维护自定义安装流程"更优:**
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
This section promotes
curl | bashas the preferred installation method because it is simpler and faster, normalizing an unsafe execution pattern. That pattern bypasses review and integrity validation of fetched code, so a compromised endpoint or tampered installer can immediately execute arbitrary shell commands.- Content
md **为什么"维护自定义安装流程"更优:** 1. **控制:** ClawLite 安装脚本可随产品需求演进 2. **简单:** 当前 `curl | bash` 方法 50 行 shell 脚本，DMG 方法需 500+ 行 3. **速度:** Shell 脚本 5 分钟安装，DMG 下载 + 挂载 + 拖拽 + 首次运行需 10-15 分钟 4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The recommendation to keep
curl | bashas the primary distribution channel materially increases risk because it encourages widespread execution of unaudited remote scripts. In the context of developer tooling and agent/workspace setup, such scripts may access local files, credentials, git configuration, or modify execution environments, amplifying the consequences of compromise.- Content
md 4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program) **推荐混合方法:** - **主要分发:** 保持 `curl | bash` (开发者和 CLI 用户) - **次要分发 (未来):** 添加 Homebrew formula (可发现性和信任) - **第三分发 (如果添加 GUI):** 使用 `create-dmg` 打包未来 Electron 仪表板
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Even in the risk section, the document still frames
curl | bashas an acceptable release-first approach, reinforcing insecure operational guidance. This can propagate unsafe installation behavior across users and teams, increasing the chance of arbitrary code execution if the installer source is ever compromised.- Content
md ### P1 风险 - **过早采用复杂安装框架:** 推荐混合方法避免过度工程化 - **忽略用户反馈:** 先发布 `curl | bash`，根据反馈迭代 ---
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
tup
Daily Backup (Cron)
bash # Add to crontab: crontab -e 0 2 * * * cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/backup.mjs --name "daily-$(date +\%Y-\%m-\%d)"Pre-Deployment Hook
bash # Before deploying changes cd soul-backup-skill node scripts/backup.mjs --name "pre-deploy-$(git rev-parse --short HEAD)"Weekly Validation
bash # Add to crontab 0 3 * * 0 cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/validate.mjs
Risks & Mitigations
Risk 1: Backup Directory Corruption
Mitigation:
- Store backups in git-tracked directory
- Enable Time Machine backups
- Consider off-machine backup sync (rsync to remote server)
Risk 2: Hash Collision (SHA-256)
Likelihood: Negligible (2^256 space) Mitigation: None required (cryptographically secure)
Risk 3: Restore Overwrites Wrong Files
Mitigation:
- ALWAYS use
--dry-runfirst - Automatic pre-restore backup created before
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The documentation explicitly instructs use of a force option to overwrite existing files during restore conflict handling, which is a self-modifying operation against sensitive workspace control files. Although expected in a backup tool, this remains dangerous because these files govern agent identity, instructions, and tooling, so an incorrect restore or malicious backup could replace trusted configuration.
- Content
md - Backup may be corrupted — use previous backup **"Restore failed: file conflicts"** - Use `--force` flag to overwrite existing files - Or manually move conflicting files before restore ## Future Enhancements
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file's behavior is materially unrelated to the declared daily backup/restore purpose and instead bootstraps identity, persona, user profiling, and channel onboarding. In a backup skill context, this mismatch is dangerous because it can redirect the agent into collecting personal data and performing unrelated actions under the trusted label of a recovery/protection tool.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file presented as a 'daily backup' skill is actually a broad runtime snapshot containing agent configuration, channel settings, provider integrations, execution policy, and authentication-related material. That scope mismatch is dangerous because a backup skill should be narrowly limited, while this artifact exposes operational capabilities and sensitive system structure that could be repurposed for persistence, lateral use, or unauthorized reconfiguration.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This configuration enables capabilities far beyond backup operations, including unrestricted subagent use ('*'), agent-to-agent operation, and command execution with confirmation disabled. In the context of a backup skill, these controls materially increase the risk that a restore or imported snapshot could grant broad execution authority or be abused as an operational control plane rather than a passive backup.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file is a broad persona and workspace-governance prompt, not a narrowly scoped backup/restore skill. Embedding global operating instructions inside a backup skill can override task boundaries and cause the agent to read unrelated sensitive files, assume persistent autonomy, and perform actions far beyond backup or recovery.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill authorizes web access, calendar checks, and potentially sending communications, which are unrelated to daily backup of identity/config files. In a backup-skill context, these permissions unnecessarily expand the agent's capability surface and create opportunities for data exfiltration, unintended external actions, or misuse of connected accounts.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The heartbeat section instructs the agent to perform periodic monitoring of email, calendar, social notifications, weather, and memory maintenance, none of which are necessary for backup operations. In this context it effectively turns a backup skill into a general autonomous monitoring agent with recurring access to sensitive personal data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file's behavior is materially unrelated to the declared backup/recovery purpose of the skill and instead directs identity bootstrapping, profile collection, and social onboarding. In a backup skill context, this scope mismatch is dangerous because it can cause unauthorized collection of personal data, unexpected file modification, and user redirection into workflows that are outside the user's likely consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file defines a standing personal-assistant identity, loyalty model, reporting behavior, memory model, and broad operational workflow that far exceeds the declared purpose of a backup/restore skill. In a backup context, these instructions can cause unauthorized persistence, cross-task behavior shaping, and covert handling of sensitive workspace data, making the skill effectively a general-purpose agent override rather than a narrowly scoped backup tool.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This configuration enables broad capabilities unrelated to a daily backup skill, including unrestricted agent allowance, external messaging channels, plugin activation, and networked gateway access. If this backup content is restored or trusted as part of the skill, an attacker could leverage the excessive permissions and integrations to expand control, trigger remote interactions, or persist unsafe runtime behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The emergency recovery example uses
cp -r .../* .in the workspace root, which can silently overwrite existing files without any warning or confirmation step. Because this skill's purpose is restoring core workspace identity/config files, the context makes overwrite risk more acute: users may run this during stressful recovery scenarios and unintentionally replace valid or newer data.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README draft presents
node scripts/restore.mjsas a quick-start command without clearly warning that restore operations overwrite existing workspace identity/config files. In a backup/restore skill, users are especially likely to copy-paste commands, so omission of an overwrite warning increases the chance of accidental destructive changes and unsafe use.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Example 1: Daily Automated Backup
Create a daily backup at 2 AM with automatic naming:
bash # Add to crontab: crontab -e
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The restore examples instruct users to perform a real restore after only a dry-run preview, but they do not explicitly warn that the operation will overwrite current workspace files and may discard newer changes. In a backup/rollback skill, users are especially likely to run these commands during recovery, so omission of a destructive-action warning increases the chance of accidental data loss.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
CLI commands:
bash clawlite backup # Create timestamped backup clawlite backup --name "pre-migration" # Named backup clawlite restore # Restore latest clawlite restore --name "pre-migration" # Restore named
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The feature explicitly stores raw backups under a local directory while the same document acknowledges backups may contain API keys and sensitive identity/config data. Because the storage description appears without a prominent user-facing warning or mandatory protection requirement nearby, users may create plaintext backups in a predictable location and unintentionally expose secrets to other local users, backup tools, or malware.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all operational instructions and safety-relevant recovery steps only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content