OpenClaw Backup & Restore

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:39 AM UTC
• Version: 1.5.4

Overview

The skill is a real backup/restore tool, but its Git sync can upload sensitive OpenClaw config by default and some restore paths are not tightly controlled.

Review before installing. Use local sanitized backups by default, do not run backup-and-push unless the destination repo is private and intentionally meant to hold secrets, and prefer --sanitized-config-only for any Git sync. Run restore with --dry-run first, avoid untrusted backup names or manifests, and do not schedule cron-based remote backups until the raw-config default and path validation issues are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup-and-push.mjs:16

Finding

Git synchronization exports raw OpenClaw credentials by default

Content

View full analysis

Vulnerability Details

File Location: scripts/backup-and-push.mjs:16-21, 88-112; scripts/backup.mjs:214-226
Vulnerability Type: Sensitive data exposure through an unsafe backup default
Risk Level: High

Vulnerable Code

js

const options = {
  branch: 'main',
  remote: 'clawlite-backup',
  message: null,
  rawOpenClawConfig: true
};

js

function main() {
  const backupArgs = ['scripts/backup.mjs'];
  if (options.rawOpenClawConfig) backupArgs.push('--raw-openclaw-config');

  console.log('🔍 Creating backup before git push...');
  run('node', backupArgs, { cwd: SKILL_ROOT });

  const latest = latestBackupDir();
  console.log(`✅ Latest backup: ${latest}`);

  const remoteUrl = run('git', ['remote', 'get-url', options.remote], { cwd: SKILL_ROOT });
  ensureBackupRepo(remoteUrl);
  syncBackupsIntoRepo();

  run('git', ['add', 'backups'], { cwd: BACKUP_REPO_DIR });

  const status = run('git', ['status', '--short', 'backups'], { cwd: BACKUP_REPO_DIR });
  if (!status) {
    console.log('ℹ️  No backup changes to commit.');
    return;
  }

  const message = options.message || `backup: ${latest}`;
  run('git', ['commit', '-m', message], { cwd: BACKUP_REPO_DIR });
  run('git', ['push', 'origin', options.branch], { cwd: BACKUP_REPO_DIR });
}

js

if (options.rawOpenClawConfig) {
  const size = backupFile({
    sourcePath: openclawJsonPath,
    backupRelativePath: 'openclaw.json',
    manifest,
    backupPath,
    restoreTo: 'openclaw_root'
  });
  manifest.files['openclaw.json'].raw = true;
  manifest.files['openclaw.json'].original = '~/.openclaw/openclaw.json';
}

Technical Analysis

The Git synchronization command initializes rawOpenClawConfig to true. Consequently, running backup-and-push.mjs without the opt-out flag automatically invokes backup.mjs --raw-openclaw-config.

Raw mode copies ~/.openclaw/openclaw.json ...[truncated 1666 chars]

Remediation

View remediation

Remediation Suggestions

1. Change rawOpenClawConfig to false by default.
2. Require an explicit --raw-openclaw-config option for each raw export.
3. Require interactive confirmation before committing raw configuration, with a clearly named override for unattended execution.
4. Encrypt raw configuration before placing it in Git-backed storage.
5. Add secret scanning before git commit and abort if likely credentials are detected.
6. Exclude openclaw.json through repository-level ignore and pre-commit controls unless an encrypted workflow is explicitly enabled.
7. Clearly state that repository privacy cannot be assumed or reliably inferred by the script.
8. If exposure has already occurred, revoke affected credentials and rewrite repository history rather than merely deleting the file in a new commit.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup.mjs:35

Finding

Unvalidated backup names permit directory traversal outside backup storage

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.mjs:35-39, 138-145; scripts/restore.mjs:61-75; scripts/validate.mjs:130-146
Vulnerability Type: Path traversal through an unrestricted backup name
Risk Level: Medium

Vulnerable Code

js

if (args[i] === '--name' && args[i + 1]) {
  options.name = args[i + 1];
  i++;
}

js

const backupPath = options.name
  ? path.join(BACKUP_DIR, 'named', options.name)
  : path.join(BACKUP_DIR, timestamp);

if (fs.existsSync(backupPath)) {
  console.error(`❌ Backup already exists: ${backupPath}`);
  process.exit(1);
}

fs.mkdirSync(backupPath, { recursive: true });

Restore and validation construct paths from the same unrestricted value:

js

if (options.name) {
  const namedPath = path.join(BACKUP_DIR, 'named', options.name);
  if (!fs.existsSync(namedPath)) {
    console.error(`❌ Named backup not found: ${options.name}`);
    process.exit(1);
  }
  return namedPath;
}

Technical Analysis

The --name argument is incorporated into filesystem paths without validation or a canonical containment check. A value containing traversal components such as ../../ can resolve outside BACKUP_DIR/named.

During backup, this permits workspace state, agent Markdown files, and optionally configuration data to be copied into an arbitrary writable directory reachable by the current user. Restore and validation can likewise be redirected to directories outside the configured backup root. If an attacker can prepare content and a manifest in such a location, the restore operation may treat that content as a trusted backup.

Exploitation requires influence over command arguments or automation configuration. It does not independently grant privileges beyond those of the user running the Skill.

Attack Path

1. An attacker influences a command, wrapper, scheduled job, or configuration that supplies --name.

...[truncated 990 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict backup names to a conservative pattern, such as ^[A-Za-z0-9._-]+$.
2. Explicitly reject absolute paths, path separators, empty names, . components, and .. components.
3. Resolve the destination with path.resolve() and verify that it remains beneath the canonical BACKUP_DIR/named root.
4. Include a trailing path separator in containment comparisons to avoid prefix-collision bypasses.
5. Resolve real paths of existing parent directories to prevent symlink-based escapes.
6. Apply identical validation in backup, restore, list, and validation scripts.
7. Validate backup manifests against a strict schema before trusting their contents.
8. Add negative tests for traversal strings, absolute paths, mixed separators, and symlink escapes.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/restore.mjs:36

Finding

Single-file restore accepts traversal paths instead of allowlisted filenames

Content

View full analysis

Vulnerability Details

File Location: scripts/restore.mjs:36-40, 172-181, 231-242
Vulnerability Type: Path traversal in the single-file restore operation
Risk Level: Medium

Vulnerable Code

js

} else if (args[i] === '--file' && args[i + 1]) {
  options.file = args[i + 1];
  i++;
}

js

const filesToRestore = options.file
  ? [options.file]
  : SOUL_FILES;

let restoredCount = 0;
let skippedCount = 0;
let sanitizedConfigFound = false;

console.log('Files to restore:');
for (const filename of filesToRestore) {
  const sourcePath = path.join(backupPath, filename);
  const destPath = path.join(WORKSPACE_ROOT, filename);
  const fileInfo = manifest.files[filename];

js

for (const filename of filesToRestore) {
  const sourcePath = path.join(backupPath, filename);
  const destPath = path.join(WORKSPACE_ROOT, filename);
  const fileInfo = manifest.files[filename];

  if (!fileInfo || !fileInfo.exists || !fs.existsSync(sourcePath)) {
    continue;
  }

  fs.copyFileSync(sourcePath, destPath);
  console.log(`✅ Restored: ${filename}`);
}

Technical Analysis

The documented single-file feature is intended to restore one of the fixed SOUL_FILES, but --file accepts any string. The value is used to construct both the source and destination paths without an allowlist or containment check.

Traversal components can therefore resolve outside both the selected backup directory and WORKSPACE_ROOT. Successful exploitation requires a matching manifest.files entry and an accessible source file. This prerequisite can be met using a crafted backup manifest, especially when combined with the unrestricted --name issue.

The automatic pre-restore backup does not prevent exploitation. It creates copies of the normal workspace files but does not make arbitrary overwritten destinations safe.

Attack Path

1. An attacker creates or influences a ba ...[truncated 1038 chars]

Remediation

View remediation

Remediation Suggestions

1. Require --file to exactly match an entry in the fixed SOUL_FILES allowlist.
2. Reject absolute paths, separators, and traversal components before any filesystem access.
3. Resolve source and destination paths and verify that they remain under the selected backup directory and workspace root, respectively.
4. Validate manifest keys against a strict schema and reject entries outside the supported file set.
5. Check for symlinks in source paths and refuse restore operations that escape the canonical backup root.
6. Consider restoring through temporary files followed by atomic rename after all validation succeeds.
7. Add tests covering ../, absolute paths, platform-specific separators, crafted manifest keys, and symlink traversal.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (45)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manual recovery example uses cp -r .../* . to copy backup contents into the current directory, which can silently overwrite existing files depending on environment and user assumptions, with no warning or safeguards. Because it targets a workspace root and is framed as emergency recovery, a user under stress may run it immediately and destroy good state or merge incompatible files.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The report explicitly endorses a one-click install model using curl|bash, which is a classic unsafe pattern because it downloads and immediately executes remote code without independent verification. In the context of an agent ecosystem, normalizing this pattern is especially dangerous because it can cause users or downstream automation to trust and run unreviewed installer scripts.

Content

Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 168)May include surrounding context.

md

**为什么不"直接复用现有方案":**
1. **架构不匹配:** 大多数工具假设打包 .app bundle，ClawLite 是 Node.js CLI 工具
2. **依赖地狱:** 采用 electron-builder 会增加 200+ 依赖
3. **用户体验差距:** ClawLite 的 "one-click install" (`curl | bash`) 与 DMG 下载流程不同
4. **维护负担:** 继承复杂安装框架意味着调试他人代码、跟踪上游破坏性更改

**为什么"维护自定义安装流程"更优:**

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This section presents curl|bash as a preferred installation approach due to simplicity and speed, reinforcing direct remote script execution as a recommended practice. That guidance can facilitate arbitrary code execution if the hosting endpoint, transport path, or script source is compromised, and the skill context does not mitigate that risk because installer distribution is outside its legitimate purpose.

Content

Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 173)May include surrounding context.

md

**为什么"维护自定义安装流程"更优:**
1. **控制:** ClawLite 安装脚本可随产品需求演进
2. **简单:** 当前 `curl | bash` 方法 50 行 shell 脚本，DMG 方法需 500+ 行
3. **速度:** Shell 脚本 5 分钟安装，DMG 下载 + 挂载 + 拖拽 + 首次运行需 10-15 分钟
4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The recommended hybrid distribution model lists curl|bash as the primary distribution channel, making unsafe remote script execution a central operational recommendation. Because this appears in a skill report, it may be treated as approved implementation guidance and increase the likelihood of insecure supply-chain behavior across deployments.

Content

Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 178)May include surrounding context.

md

4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program)

**推荐混合方法:**
- **主要分发:** 保持 `curl | bash` (开发者和 CLI 用户)
- **次要分发 (未来):** 添加 Homebrew formula (可发现性和信任)
- **第三分发 (如果添加 GUI):** 使用 `create-dmg` 打包未来 Electron 仪表板

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The risk section recommends releasing with curl|bash first and iterating later, which normalizes deployment of an unsafe execution pattern before security hardening. This is dangerous because it frames a high-risk installation method as an acceptable default, creating exposure to remote code execution and supply-chain compromise from the outset.

Content

Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 318)May include surrounding context.

md

### P1 风险
- **过早采用复杂安装框架:** 推荐混合方法避免过度工程化
- **忽略用户反馈:** 先发布 `curl | bash`，根据反馈迭代

---

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · P0-1-DELIVERY-REPORT.md (reported line 164)May include surrounding context.

tup

Daily Backup (Cron)

bash

# Add to crontab: crontab -e
0 2 * * * cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/backup.mjs --name "daily-$(date +\%Y-\%m-\%d)"

Pre-Deployment Hook

bash

# Before deploying changes
cd soul-backup-skill
node scripts/backup.mjs --name "pre-deploy-$(git rev-parse --short HEAD)"

Weekly Validation

bash

# Add to crontab
0 3 * * 0 cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/validate.mjs

---

Risks & Mitigations

Risk 1: Backup Directory Corruption

Mitigation:

• Store backups in git-tracked directory
• Enable Time Machine backups
• Consider off-machine backup sync (rsync to remote server)

Risk 2: Hash Collision (SHA-256)

Likelihood: Negligible (2^256 space) Mitigation: None required (cryptographically secure)

Risk 3: Restore Overwrites Wrong Files

Mitigation:

• ALWAYS use --dry-run first
• Automatic pre-restore backup created before

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The skill includes automated git add/commit/push behavior with a user-supplied remote, which can exfiltrate sensitive backups containing configuration, prompts, and possibly secrets to unintended destinations. Because the backup set may include real openclaw.json and other sensitive files, remote push functionality substantially raises the impact beyond ordinary local backup operations.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Daily GitHub Backup

bash

# Create backup, git add backups/, git commit, and git push to origin/current-branch
node scripts/backup-and-push.mjs --remote origin

# Push to a dedicated backup remote

Self-Modification

High

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This skill explicitly supports force-overwriting existing workspace files during restore. Even if intended for recovery, self-modification of critical agent state files can permanently alter instructions, identity, or tool configuration, and could be abused to replace trusted state with stale or malicious content.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

- Backup may be corrupted — use previous backup

**"Restore failed: file conflicts"**
- Use `--force` flag to overwrite existing files
- Or manually move conflicting files before restore

## Future Enhancements

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The report presents restore commands as routine workflow steps without an immediate warning that they overwrite workspace state. In a backup/restore skill, users are likely to copy commands directly, so missing destructive-operation warnings increases the chance of accidental data loss or unintended rollback of configuration and agent state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The draft README quick start includes node scripts/restore.mjs as a simple example without clarifying that it modifies user files. Quick-start sections are especially risky because they encourage direct execution, so omitting a warning can lead to accidental restoration over the current workspace.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · EXAMPLES.md (reported line 5)May include surrounding context.

Example 1: Daily Automated Backup

Create a daily backup at 2 AM with automatic naming:

bash

# Add to crontab: crontab -e

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The restore example performs a rollback operation directly after a dry-run preview, but the example does not explicitly warn that the actual restore may overwrite current agent files and revert valid changes. Because restore is inherently destructive in this context, lack of warning can lead to operator error and unintended loss of state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual recovery example uses cp -r .../* ., which can overwrite existing workspace files during an emergency restore without clearly warning the user that local changes may be destroyed. In a backup/restore skill this behavior is expected, but omitting an explicit destructive-action warning increases the risk of accidental data loss or rollback of newer state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The feature explicitly stores backups of agent state files and notes elsewhere that backups may contain API keys, yet the main user-facing backup description and CLI workflow do not prominently warn that v1 backups are unencrypted and may contain sensitive credentials. This can lead users to create or move backups under a false sense of safety, increasing the risk of credential exposure through local compromise, shared accounts, or copied backup directories.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · FEATURE_DEFINITION.md (reported line 56)May include surrounding context.

CLI commands:

bash

clawlite backup                              # Create timestamped backup
clawlite backup --name "pre-migration"       # Named backup
clawlite restore                             # Restore latest
clawlite restore --name "pre-migration"      # Restore named

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file presents the skill-related delivery report entirely in Chinese, including headings and operational instructions, with no indication that language choice is optional or user-configurable. Under the policy rule, forcing a specific language without opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delivery report documents GitHub publishing, release management, community promotion, and repository initialization steps that are outside the stated purpose of a backup/restore skill. Scope drift in an agent skill is dangerous because it encourages actions with broader external effects, increasing the chance the agent performs unintended publishing or distribution tasks under the guise of backup operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Installer research and recommendations for curl|bash, Homebrew, DMG, and binary packaging are unrelated to the declared backup/restore function of this skill. This expands the operational scope from local state protection into software distribution guidance, which can lead an agent to recommend or prepare risky installation pathways that were never required for the backup task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The restore instructions explicitly describe copying backup contents into the workspace and using restore commands that overwrite files, but they do not place a prominent data-loss warning directly alongside those steps. In a backup/restore skill, operators may follow these instructions during stressful recovery scenarios, increasing the chance of unintended overwrites of newer user data or restoration into the wrong directory.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The quickstart instructs users to install a differently named repository and repeatedly refers to a different skill name than the declared OpenClaw backup skill. In a security-sensitive backup/restore context, this can misdirect users to the wrong codebase, causing installation of unreviewed software or use of incorrect recovery tooling, which undermines trust and could expose state files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The restore example tells users to run restore commands without clearly warning that restoration overwrites existing SOUL/workspace files. In a backup/rollback skill, omission of that warning increases the chance of destructive operator error, especially when users may execute commands directly from the quickstart.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

chmod +x scripts/*.mjs

text

### Create Your First Backup

```bash
# Default: backup workspace files + sanitized openclaw.json

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly promotes backing up the real ~/.openclaw/openclaw.json to GitHub/private repositories for off-machine recovery, but it does not clearly warn that this file may contain API keys, tokens, credentials, or other secrets. In a backup skill, this context makes the issue more dangerous because users are being encouraged to export and replicate sensitive state off-machine, increasing the chance of credential exposure through repo compromise, misconfiguration, or accidental publication.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest identifies this skill as "openclaw-backup-restore", but the checklist says it is for publishing "SOUL Backup Skill". This is an active documentation contradiction about the artifact being released, which can mislead maintainers about what skill the repository actually contains.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · RELEASE_CHECKLIST.md (reported line 42)May include surrounding context.

1. GitHub Repository Setup

bash

# Create new repository on GitHub
# Repository name: soul-backup
# Description: One-click backup and restore for OpenClaw workspace SOUL files
# License: MIT

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/backup-and-push.mjs:36