T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/smart-backup.sh:26- Finding
Authentication credentials are duplicated without explicit backup permission hardening
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Recovery
Security checks for vulnerabilities and agentic risk
Overview
The skill’s recovery purpose is coherent, but it installs persistent automatic jobs that can change OpenClaw configuration and backs up authentication files with unsafe handling.
Review before installing. This skill is not clearly malicious, but it should be treated as high-impact: it installs recurring cron jobs, can automatically overwrite OpenClaw config and restart the gateway, and backs up authentication files. Install only if you accept unattended recovery, verify backup directory permissions, and check that the uninstaller will not remove unrelated backup or recovery jobs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rollback.sh:14- Finding
Crafted backup filenames can inject code into Python validation commands
- Content
View full analysis
/dev/null)) for i in "${!BACKUPS[@]}"; do BACKUP="${BACKUPS[$i]}" FILENAME=$(basename "$BACKUP") DATE=$(echo "$FILENAME" | grep -o '[0-9]\{8\}_[0-9]\{6\}') FORMATTED_DATE=$(date -j -f "%Y%m%d_%H%M%S" "$DATE" "+%Y-%m-%d %H:%M:%S" 2>/dev/null || echo "$DATE") if python3 -c "import json; json.load(open('$BACKUP'))" 2>/dev/null; then STATUS="valid" else STATUS="corrupt" fi done ``` Equivalent unsafe validation in `scripts/recover.sh:38-42`: ```bash for BACKUP in $(ls -t "$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | head -$MAX_RETRIES); do if ! python3 -c "import json; json.load(open('$BACKUP'))" 2>/dev/null; then continue fi ``` Equivalent unsafe validation in `scripts/recover-v2.sh:343-347`: ```bash for BACKUP in $(ls -t "$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | head -$MAX_RETRIES); do backup_errors=$(validate_config "$BACKUP" 2>&1) if [ $? -ne 0 ]; then continue fi ``` The `validate_config` function eventually performs: ```bash python3 -c "import json; json.load(open('$config'))" ``` ### Technical Analysis Backup paths are discovered by parsing `ls` output through unquoted command substitution. This subjects filenames to shell word splitting and makes spaces, tabs, and newlines alter array and loop boundaries. More critically, each resulting path is embedded inside a single-quoted Python string within a `python3 -c` program: ```bash python3 -c "import json; json.load(open('$BACKUP'))" ``` Shell metacharacters inside `$BACKUP` do not cause direct she ...[truncated 1948 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/uninstall.sh:24- Finding
Uninstaller removes unrelated cron jobs and terminates unrelated processes
- Content
View full analysis
/dev/null | grep -q "openclaw-recovery\|recover.sh\|backup.sh"; then crontab -l 2>/dev/null | grep -v "openclaw-recovery" | grep -v "recover.sh" | grep -v "backup.sh" | crontab - 2>/dev/null || true fi ``` Process termination at `scripts/uninstall.sh:35-36`: ```bash pkill -f "smart-backup.sh watch" 2>/dev/null || true pkill -f "recover.sh" 2>/dev/null || true ``` ### Technical Analysis The installer creates cron entries with Skill-specific paths containing `openclaw-recovery`. The uninstaller nevertheless removes all user cron lines containing the generic substrings `recover.sh` or `backup.sh`. Those names are not unique to this project. A user may legitimately have unrelated disaster-recovery, database-backup, or application-monitoring jobs with either substring. Piping the filtered result back to `crontab -` permanently removes every matching entry without displaying the affected lines or asking for confirmation. The process cleanup has the same problem. `pkill -f "recover.sh"` matches the entire command line and may terminate unrelated scripts whose paths or arguments contain that generic name. It does not verify the executable path, parent process, PID ownership record, or association with this Skill. Cron-based persistence itself is disclosed and functionally necessary for the advertised continuous monitoring. The security issue is the uninstaller's failure to restrict cleanup to the exact persistence entries and processes created by this project. ### Attack Path 1. The user has unrelated cron jobs containing `backup.sh` or `recover.sh`, or an unrelated recovery process is running. 2. The user invokes the advertised `scripts/uninstall.sh` command. 3. The script removes ...[truncated 889 chars]- Remediation
View remediation
/dev/null | grep -Fv '# openclaw-recovery:' | crontab - ``` 3. Avoid generic `pkill -f` patterns. Record the PID when starting a persistent watcher in a user-private PID file, then verify the process command and ownership before terminating it. 4. If command-line matching is unavoidable, match the canonical full path: ```bash pkill -f -- "$INSTALL_DIR/scripts/smart-backup.sh watch" ``` 5. Display the exact cron entries and processes selected for removal before modifying them. 6. Preserve a crontab backup before applying changes and restore it automatically if installation of the filtered crontab fails. 7. For Windows, use a uniquely named scheduled task and provide an exact command to remove only that task. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (48)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
The cleanup pipeline uses
ls ... | tail ... | xargs rm -f, which is unsafe because filenames are parsed through whitespace-delimited text processing. If a crafted backup filename contains spaces, newlines, or begins with option-like content,xargs rmmay delete unintended files or behave unpredictably; using shell pipelines for deletion also creates avoidable fragility around edge cases.- Content
sh cp "$CONFIG_FILE" "$BACKUP_FILE" # 保留最近20个备份，删除旧的 ls -t "$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null echo "备份完成: $BACKUP_FILE"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "[\$(date)] 备份完成 - 原因: \$reason" >> "\$LOG_FILE" # 清理：保留最近20个 + 7天历史 ls -t "\$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "\$BACKUP_DIR"/auth-profiles.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null find "\$BACKUP_DIR" -name "*.bak.*" -mtime +7 -type f -delete 2>/dev/null }
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "[\$(date)] 备份完成 - 原因: \$reason" >> "\$LOG_FILE" # 清理：保留最近20个 + 7天历史 ls -t "\$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "\$BACKUP_DIR"/auth-profiles.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null find "\$BACKUP_DIR" -name "*.bak.*" -mtime +7 -type f -delete 2>/dev/null }
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 94% confidence
- Finding
The YARA hit is triggered by cron-based persistence, and in this file that persistence is real even though there is no obvious secondary malware payload. Because the installer creates recurring background execution of recovery scripts that can alter configuration and restart services, this is security-significant behavior in a skill distribution context.
- Content
sh ================== echo "[4/5] 创建首次备份..." bash "$INSTALL_DIR/scripts/generated/backup.sh" # ==================== 定时任务 ==================== echo "[5/5] 设置定时任务..." case "$OS" in macos|linux) CRON_RECOVER="*/5 * * * * bash $INSTALL_DIR/scripts/generated/recover.sh" CRON_DAILY="0 2 * * * bash $INSTALL_DIR/scripts/generated/backup.sh daily" (crontab -l 2>/dev/null | grep -v "openclaw-recovery"; echo "$CRON_RECOVER"; echo "$CRON_DAILY") | crontab - echo " cron 定时任务已设置" ;; windows) echo "" echo " ⚠️ Windows 请手动设置定时任务：" echo " 1. 打开「任务计划程序」" echo " 2. 创建任务 → 触发器 → 每 5 分钟" echo " 3. 操作 → 启动程序: bash $INSTALL_DIR/scripts/generated/recover.sh" echo "" echo " 或使用 PowerShell（管理员）：" echo " \$action = New-ScheduledTaskAction -Execute 'bash
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script automatically replaces the active configuration with backup or safe-mode files and restarts the gateway, without user approval and without checking whether the restored config weakens security settings or restores stale secrets. In this skill context, a recovery script runs with the user's privileges against security-relevant auth and gateway configuration, so rollback to an older state could re-enable unsafe settings, revert protective changes, or restore compromised configuration after an incident.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
Using ls output piped into xargs rm is an unsafe deletion pattern because filenames are parsed by whitespace and special characters, which can cause unintended files in the backup directory to be deleted if crafted names are present. In this script the damage is somewhat limited by the fixed backup directory and filename prefix, but shell-pipeline deletion remains brittle and should not be used for destructive operations.
- Content
sh # 清理备份函数 cleanup_backups() { # 保留最近20个 ls -t "$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "$BACKUP_DIR"/auth-profiles.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "$BACKUP_DIR"/auth-state.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
This deletion pipeline has the same unsafe parsing issue: filenames from ls are split by xargs, so spaces, newlines, or option-like names can lead to incorrect deletions. Because the script handles credential backups, accidental deletion can interfere with recovery and may be triggered if an attacker can place crafted files in the backup directory.
- Content
sh cleanup_backups() { # 保留最近20个 ls -t "$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "$BACKUP_DIR"/auth-profiles.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "$BACKUP_DIR"/auth-state.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null # 删除7天前的备份（保留每天最新的一个）
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
This is another instance of unsafe command chaining for file deletion. Although the glob prefix narrows the target set, relying on ls and xargs for destructive actions can still mishandle unusual filenames and produce unintended deletions within the backup store.
- Content
sh # 保留最近20个 ls -t "$BACKUP_DIR"/openclaw.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "$BACKUP_DIR"/auth-profiles.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null ls -t "$BACKUP_DIR"/auth-state.json.bak.* 2>/dev/null | tail -n +21 | xargs rm -f 2>/dev/null # 删除7天前的备份（保留每天最新的一个） find "$BACKUP_DIR" -name "*.bak.*" -mtime +7 -type f -delete 2>/dev/null
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
sh �平台） set -e echo "=== OpenClaw 自救系统卸载 ===" echo "" INSTALL_DIR="$HOME/.openclaw/workspace/skills/openclaw-recovery" # 检测 OS case "$(uname -s)" in Darwin*) OS="macos" ;; Linux*) OS="linux" ;; MINGW*|MSYS*|CYGWIN*) OS="windows" ;; *) OS="unknown" ;; esac echo "[系统] $OS" # 移除 cron（macOS/Linux） case "$OS" in macos|linux) if crontab -l 2>/dev/null | grep -q "openclaw-recovery\\|recover.sh\\|backup.sh"; then crontab -l 2>/dev/null | grep -v "openclaw-recovery" | grep -v "recover.sh" | grep -v "backup.sh" | crontab - 2>/dev/null || true echo "✅ 已移除 cron 定时任务" fi ;; windows) echo " 如有定时任务，请在「任务计划程序」中手动删除 OpenClaw-Recovery" ;; esac # 停止可能运行的进程 pkill -f "smart-backup.sh watch" 2>/dev/null || true pkill -f "recover.sh" 2>/dev/null || true rm -f "$HOME/.openclaw/backup-watch.pid" 2>/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # 停止可能运行的进程 pkill -f "smart-backup.sh watch" 2>/dev/null || true pkill -f "recover.sh" 2>/dev/null || true rm -f "$HOME/.openclaw/backup-watch.pid" 2>/dev/null || true echo "✅ 已停止后台进程" # 询问删除备份和日志
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
rm -rfis inherently destructive, and this script recursively deletes a backup directory after only a single-character confirmation. Although the path is fixed and under$HOME, the context makes this more sensitive because it removes recovery data that could be needed after mistakes or compromise, creating data-loss risk if run unintentionally or in an unexpected environment.- Content
sh echo if [[ $REPLY =~ ^[Yy]$ ]]; then rm -rf "$HOME/.openclaw/backups" rm -f "$HOME/.openclaw/logs/recovery.log" rm -f "$HOME/.openclaw/logs/recovery-history.log" rm -f "$HOME/.openclaw/logs/backup.log"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh if [[ $REPLY =~ ^[Yy]$ ]]; then rm -rf "$HOME/.openclaw/backups" rm -f "$HOME/.openclaw/logs/recovery.log" rm -f "$HOME/.openclaw/logs/recovery-history.log" rm -f "$HOME/.openclaw/logs/backup.log" rm -f "$HOME/.openclaw/logs/backup-watch.log"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh if [[ $REPLY =~ ^[Yy]$ ]]; then rm -rf "$HOME/.openclaw/backups" rm -f "$HOME/.openclaw/logs/recovery.log" rm -f "$HOME/.openclaw/logs/recovery-history.log" rm -f "$HOME/.openclaw/logs/backup.log" rm -f "$HOME/.openclaw/logs/backup-watch.log" echo "✅ 已删除备份和日志"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh rm -rf "$HOME/.openclaw/backups" rm -f "$HOME/.openclaw/logs/recovery.log" rm -f "$HOME/.openclaw/logs/recovery-history.log" rm -f "$HOME/.openclaw/logs/backup.log" rm -f "$HOME/.openclaw/logs/backup-watch.log" echo "✅ 已删除备份和日志" else
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh rm -f "$HOME/.openclaw/logs/recovery.log" rm -f "$HOME/.openclaw/logs/recovery-history.log" rm -f "$HOME/.openclaw/logs/backup.log" rm -f "$HOME/.openclaw/logs/backup-watch.log" echo "✅ 已删除备份和日志" else echo "📁 备份和日志已保留"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh read -p "是否删除保底配置 (safe-mode.json)？(y/n): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then rm -f "$HOME/.openclaw/safe-mode.json" echo "✅ 已删除" else echo "📁 已保留"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file advertises safety-relevant behaviors including automatic configuration changes, rollback to backups, log deletion, and uninstall operations. Although the features are described, the README does not include a clear user warning that these actions can modify or remove configuration, backups, logs, or scheduled tasks, which is the kind of disclosure required for markdown skill descriptions affecting user data or system integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The installation instructions state that the script will configure cron jobs for recurring health checks and backups, enabling persistent unattended execution. In a skill ecosystem, persistence materially changes the trust boundary because the skill continues operating after installation and can repeatedly modify configuration or system state without further user confirmation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The README instructs users to edit crontab to schedule recurring execution of the recovery script, which establishes persistence. While this is openly documented and likely intended for reliability, persistent scheduled execution increases risk because any flaw or unsafe behavior in the recovery script will be re-triggered automatically over time.
- Content
编辑 crontab 修改检查频率：
bash crontab -e # 默认：每 5 分钟检查一次 */5 * * * * /path/to/recover-v2.sh
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
备份在哪里？
bash ls -la ~/.openclaw/backups/
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill name, description, and author metadata are entirely presented in Chinese, which indicates a language-specific user experience. The file provides no indication that users can choose another language or that the locale restriction is intentional and justified for a region-specific use case.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "mode": "merge", "providers": { "moonshot": { "baseUrl": "https://api.moonshot.cn/v1", "api": "openai-completions", "models": [ {
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The top-level documentation says the installer 'automatically detects the OS' and 'generates an adapted version', which implies a packaging/setup role. However, the generated recover.sh performs active remediation actions including editing ~/.openclaw/openclaw.json, restoring backups, and invoking 'openclaw gateway restart' (L139-L161, L181-L216), which is materially broader than merely generating scripts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer immediately creates directories, writes executable scripts, copies files, performs an initial backup, and later enables persistence, all without an explicit confirmation prompt. In a skill/install context, silent persistent changes reduce user awareness and can normalize unsafe installation patterns that are easily repurposed for abuse.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The generated script header describes 'health monitoring and automatic recovery', which suggests liveness checks and restart behavior. In addition to monitoring/restart, the script edits configuration contents in place by changing compaction and blockStreamingDefault values before restarting (L149-L160, L188-L195), which is a stronger side effect than the header conveys.
- Content