Security audit

Clawsync Skill龙虾配置同步

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is not clearly malicious, but it can create unencrypted backups of sensitive OpenClaw data while claiming encryption and has unsafe restore scoping.

Review before installing. Do not rely on this skill to encrypt backups, and avoid backing up credentials, memory, history, or workspace files unless you separately protect the ZIP and trust the storage location. Only restore archives you created and inspected, because restore can write outside the intended OpenClaw folder.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The manifest frames the skill as OpenClaw configuration backup/restore, but the documentation expands scope to workspace projects/files and team sharing. That broader scope materially increases the chance of exfiltrating proprietary files, secrets, or unrelated user data beyond what a user reasonably expects from a configuration backup tool.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The CLI exposes an --encrypt option, but the implementation explicitly creates the backup first and only prints that encryption is not implemented. This can mislead users into believing highly sensitive backup contents such as credentials, memory, and history are protected when they are actually stored in plaintext ZIP form.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The default backup set includes the credentials directory and memory data, which is broader than a typical 'configuration backup' expectation. This increases the chance of secret disclosure because users may export or move archives assuming they only contain settings and skills, while the archive may also contain tokens, keys, or other sensitive personal data.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README explicitly states that backups may include credentials, and elsewhere advertises optional inclusion of history and workspace data, but it does not prominently warn users about the privacy sensitivity of these artifacts or the risks of exporting them to cloud/Git storage. In a backup/migration skill, this omission can lead to accidental exposure of secrets, personal data, or proprietary files, especially if users assume the tool is safe by default.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This skill handles highly sensitive data categories including credentials, memory, history, and workspace files, yet the description lacks a prominent warning that backup and restore operations may copy, transfer, or overwrite sensitive content. In a migration/share workflow, missing warnings materially increase the risk of accidental disclosure, unsafe cloud upload, or destructive restore actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tool silently includes memory and credentials without an explicit warning or confirmation, even though those directories are likely to contain secrets and private conversation data. In the context of a migration/backup skill, this makes accidental over-collection and later exposure more likely, especially when backups are shared or stored remotely.

Static analysis

No suspicious patterns detected.