Security audit

SOUL Backup Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local backup skill, but it needs Review because its restore and backup scripts can escape intended paths and may overwrite or expose local files.

Install only if you are comfortable with a local tool that reads and rewrites sensitive OpenClaw workspace files. Do not restore from untrusted or manually edited backups, avoid path separators in --name, --timestamp, or --file values, run validation and a dry run before restore, keep backups private, and avoid enabling the cron retention example until its deletion command is fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup.mjs:45
Finding: Unvalidated backup names allow writes outside the backup directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/restore.mjs:34
Finding: Restore arguments permit path traversal and restoration occurs without mandatory integrity verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples/automated-backup.sh:14
Finding: Retention command can recursively delete the entire backup repository
Content: View full analysis
/dev/null ``` ### Technical Analysis The `find` invocation specifies `-maxdepth 1` but not `-mindepth 1`. The starting path, `backups/`, is therefore itself eligible for matching. If the backup root directory has a modification time older than 30 days, it can satisfy `-type d -mtime +30`. The command then runs `rm -rf` against the root backup directory, recursively deleting every backup below it, including backups newer than 30 days. Suppressing all standard error output further reduces the chance that an operator notices cleanup failures or unexpected behavior. ### Attack Path 1. A user adopts the supplied automated backup example and registers it in cron. 2. The `backups/` directory's own modification time becomes older than 30 days. 3. The scheduled script reaches the retention command. 4. `find` includes the starting `backups/` directory in its results. 5. `rm -rf backups/` recursively removes timestamped, named, and potentially newer backups. 6. A later incident occurs, but the expected recovery points no longer exist. No attacker interaction is required; the defect can be triggered by normal long-term use. A local attacker able to manipulate directory timestamps could also accelerate the condition. ### Impact Assessment The primary impact is complete loss of local backup availability. This undermines the Skill's core disaster-recovery purpose and can leave users unable to recover agent identity, user configuration, tool instructions, and bootstrap files. The deletion is limited to the backup hierarchy when the script runs from its expected directory, but that hierarchy can contain all available recovery points. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backup.mjs:14
Finding: Sanitization can preserve secrets stored beneath sensitive object or array fields
Content: View full analysis
pattern.test(key)); if (isSensitive && typeof value === 'string' && value.length > 0) { // Replace with placeholder sanitized[key] = '[REDACTED]'; } else if (typeof value === 'object' && value !== null) { sanitized[key] = sanitizeObject(value); } else { sanitized[key] = value; } } return sanitized; } return JSON.stringify(sanitizeObject(config), null, 2); } catch (err) { return null; } } ``` ```js const destPath = path.join(backupPath, 'openclaw.sanitized.json'); fs.writeFileSync(destPath, sanitizedContent); ``` ```js const manifestPath = path.join(backupPath, 'manifest.json'); fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2)); ``` ### Technical Analysis A sensitive key is replaced only when its value is a nonempty string. If the sensitive key contains an object or array, the code recursively preserves its children. For example: ```json { "apiKeys": { "production": "real-secret-value" } } ``` The key `apiKeys` matches `/key/i` ...[truncated 1557 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manual emergency recovery example uses a recursive copy into the workspace root without warning that existing files may be overwritten. Because this bypasses any safeguards the scripts may provide, a user can unintentionally replace multiple files at once and lose the current workspace state.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The report endorses a one-click installation model using curl | bash, which executes remotely fetched code immediately without requiring inspection, integrity verification, or trusted packaging. If the hosting source, transport, DNS, repository, or update path is compromised, users could run attacker-controlled code with their local privileges.
Content: Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 168)May include surrounding context.
md
**为什么不"直接复用现有方案":** 1. **架构不匹配:** 大多数工具假设打包 .app bundle，ClawLite 是 Node.js CLI 工具 2. **依赖地狱:** 采用 electron-builder 会增加 200+ 依赖 3. **用户体验差距:** ClawLite 的 "one-click install" (`curl | bash`) 与 DMG 下载流程不同 4. **维护负担:** 继承复杂安装框架意味着调试他人代码、跟踪上游破坏性更改 **为什么"维护自定义安装流程"更优:**

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: This passage explicitly promotes curl | bash as the preferred installation method because it is simpler and faster, normalizing execution of unaudited remote code. That pattern materially increases supply-chain risk and reduces the chance that users verify provenance or script contents before execution.
Content: Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 173)May include surrounding context.
md
**为什么"维护自定义安装流程"更优:** 1. **控制:** ClawLite 安装脚本可随产品需求演进 2. **简单:** 当前 `curl | bash` 方法 50 行 shell 脚本，DMG 方法需 500+ 行 3. **速度:** Shell 脚本 5 分钟安装，DMG 下载 + 挂载 + 拖拽 + 首次运行需 10-15 分钟 4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Here the document recommends keeping curl | bash as the primary distribution channel, making the insecure pattern central to the delivery model rather than an incidental mention. In skill context, installation guidance directly influences operator behavior, so this increases the likelihood of unsafe execution and supply-chain compromise.
Content: Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 178)May include surrounding context.
md
4. **成本:** Shell 脚本无需公证费用 ($99/年 Apple Developer Program) **推荐混合方法:** - **主要分发:** 保持 `curl | bash` (开发者和 CLI 用户) - **次要分发 (未来):** 添加 Homebrew formula (可发现性和信任) - **第三分发 (如果添加 GUI):** 使用 `create-dmg` 打包未来 Electron 仪表板

External Script Fetching

High

Category: Supply Chain
Confidence: 95% confidence
Finding: This line reinforces the plan to launch first with curl | bash, which perpetuates unsafe installation guidance even if framed as iterative product strategy. Repetition in release and risk sections makes the insecure practice more likely to be adopted operationally.
Content: Scanner excerpt · FINAL-DELIVERY-REPORT.md (reported line 318)May include surrounding context.
md
### P1 风险 - **过早采用复杂安装框架:** 推荐混合方法避免过度工程化 - **忽略用户反馈:** 先发布 `curl | bash`，根据反馈迭代 ---

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · P0-1-DELIVERY-REPORT.md (reported line 164)May include surrounding context.
tup

Daily Backup (Cron)

bash
# Add to crontab: crontab -e 0 2 * * * cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/backup.mjs --name "daily-$(date +\%Y-\%m-\%d)"

Pre-Deployment Hook

bash
# Before deploying changes cd soul-backup-skill node scripts/backup.mjs --name "pre-deploy-$(git rev-parse --short HEAD)"

Weekly Validation

bash
# Add to crontab 0 3 * * 0 cd /Users/m1/.openclaw/workspace-hunter/soul-backup-skill && node scripts/validate.mjs

Risks & Mitigations

Risk 1: Backup Directory Corruption

Mitigation:

Store backups in git-tracked directory

Enable Time Machine backups

Consider off-machine backup sync (rsync to remote server)

Risk 2: Hash Collision (SHA-256)

Likelihood: Negligible (2^256 space) Mitigation: None required (cryptographically secure)

Risk 3: Restore Overwrites Wrong Files

Mitigation:

ALWAYS use --dry-run first

Automatic pre-restore backup created before

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.
md
- Backup may be corrupted — use previous backup **"Restore failed: file conflicts"** - Use `--force` flag to overwrite existing files - Or manually move conflicting files before restore ## Future Enhancements

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README quick-start presents node scripts/restore.mjs as a simple default action without an adjacent warning that restore overwrites existing workspace files. In the context of a backup/restore skill for agent workspace state, this can lead users to unintentionally replace current configuration or identity files, causing data loss or rollback to stale state.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · EXAMPLES.md (reported line 5)May include surrounding context.
Example 1: Daily Automated Backup

Create a daily backup at 2 AM with automatic naming:

bash
# Add to crontab: crontab -e

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The restore examples instruct users to run restore commands without explicitly warning that they will overwrite current workspace files. In a backup/restore skill, destructive overwrite behavior is expected, but omitting a clear warning increases the chance of accidental data loss or rollback of newer work.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · FEATURE_DEFINITION.md (reported line 56)May include surrounding context.
CLI commands:

bash
clawlite backup # Create timestamped backup clawlite backup --name "pre-migration" # Named backup clawlite restore # Restore latest clawlite restore --name "pre-migration" # Restore named

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manual recovery instructions use a recursive copy into the workspace root, which can overwrite current files without an explicit warning, confirmation step, or safer example. In a backup/restore skill, destructive restore guidance is security-relevant because it can cause integrity loss or accidental rollback of trusted workspace content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The restore examples show commands that will overwrite workspace SOUL files, but the examples do not clearly warn the user at the point of use that restoration is destructive. In a backup/restore skill, users are likely to copy-paste commands from the quick start, so missing overwrite warnings can lead to accidental data loss or rollback of newer configuration and identity files.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
chmod +x scripts/*.mjs

text
### Create Your First Backup ```bash node scripts/backup.mjs

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README documents restore procedures that overwrite workspace SOUL files and even instruct copying a sanitized config back into ~/.openclaw/openclaw.json, but it does not prominently warn that these actions can replace current state and cause irreversible loss of newer edits if used incorrectly. In a backup/restore skill, destructive overwrite is expected functionality, yet the lack of explicit confirmation, backup-before-restore warning, and recovery caveats increases the chance of accidental data loss or unsafe operator behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · RELEASE_CHECKLIST.md (reported line 42)May include surrounding context.
1. GitHub Repository Setup

bash
# Create new repository on GitHub # Repository name: soul-backup # Description: One-click backup and restore for OpenClaw workspace SOUL files # License: MIT

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown runbook instructs users to run restore commands that can overwrite workspace files, but the section does not explicitly warn that restoring may replace current data or should only be done after confirming the target state. Although dry-run is shown as an option elsewhere, the primary restore reference presents destructive commands without a direct warning in that section.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The standard recovery workflow instructs users to run the restore command after a dry run, but it does not clearly warn that applying the restore will modify or replace current workspace files. Because these files define agent behavior and configuration, an uninformed restore can unintentionally revert legitimate changes or destroy current state, especially in a shared or actively modified workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The emergency recovery instructions tell the user to copy all files from a backup directly into the workspace with cp -r .../* ., which can overwrite existing files indiscriminately. In a backup/restore skill this behavior is expected, but the lack of an explicit overwrite warning, file-by-file preview, or safer restore guidance increases the chance of destructive operator error and accidental loss of newer workspace state.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · EXAMPLES.md (reported line 8)May include surrounding context.
md
#!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · EXAMPLES.md (reported line 79)May include surrounding context.
md
#!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · P0-1-DELIVERY-REPORT.md (reported line 151)May include surrounding context.
md
#!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 223)May include surrounding context.
md
#!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · RUNBOOK.md (reported line 240)May include surrounding context.
md
#!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · RUNBOOK.md (reported line 256)May include surrounding context.
md
#!/bin/bash # Automated daily backup via cron # Add to crontab: crontab -e # 0 2 * * * /path/to/automated-backup.sh >> /tmp/soul-backup.log 2>&1 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Daily Backup (Cron)

Pre-Deployment Hook

Weekly Validation

Risks & Mitigations

Risk 1: Backup Directory Corruption

Risk 2: Hash Collision (SHA-256)

Risk 3: Restore Overwrites Wrong Files

Self-Modification

Missing User Warnings

Session Persistence

Example 1: Daily Automated Backup

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

Session Persistence

Missing User Warnings

Session Persistence

1. GitHub Repository Setup

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence