T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawsync.py:75- Finding
Encryption Requests Produce Plaintext Backups Containing Sensitive Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawsync Skill龙虾配置同步
Security checks for vulnerabilities and agentic risk
Overview
This backup skill has a coherent purpose, but its advertised encryption and restore safety do not match the implementation, creating real risk to credentials and local files.
Review this skill before installing. Do not rely on its --encrypt option, do not upload or share backups it creates unless you separately protect them, and only restore archives you fully trust. The restore code should be fixed to validate archive paths and extract only inside the OpenClaw directory before use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/clawsync.py:223- Finding
Crafted Backup Archives Can Write Outside the OpenClaw Directory
- Content
View full analysis
Dict: """Restore from backup""" backup_file = Path(backup_path).expanduser().resolve() if not backup_file.exists(): return {"error": f"Backup file not found: {backup_file}"} oc_dir = self._get_openclaw_path() try: with zipfile.ZipFile(backup_file, 'r') as zf: # Read manifest manifest_data = zf.read("manifest.json").decode('utf-8') manifest = json.loads(manifest_data) if dry_run: return { "dry_run": True, "backup_date": manifest.get("created"), "items": manifest.get("items", []), "restore_target": str(oc_dir) } # Extract all files if not oc_dir.exists(): oc_dir.mkdir(parents=True) extracted_count = 0 for item in zf.namelist(): if item in ["manifest.json", "README.txt"]: continue target_path = oc_dir / item # Check for conflicts if target_path.exists() and not overwrite: continue # Extract zf.extract(item, oc_dir.parent) extracted_count += 1 ``` ### Technical Analysis The conflict check and extraction operation use different destination roots: - The conflict check assumes the member will be written to `oc_dir / item`, normally `~/.openclaw/`. - The extraction call uses `oc_dir.parent ...[truncated 2389 chars]- Remediation
View remediation
T06 · System Persistence
Warning
- Location
SKILL.md:294- Finding
Documentation Instructs Users to Install a Persistent Scheduled Task Using Mutable Paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
Options | 选项: --backup PATH # Backup file to restore | 要恢复的备份文件 --selective # Choose what to restore | 选择性恢复 --overwrite # Overwrite existing files | 覆盖现有文件 --fresh-install # Setup on new machine | 在新机器上设置
text
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python Options | 选项: --backup PATH # Backup file to restore | 要恢复的备份文件 --selective # Choose what to restore | 选择性恢复 --overwrite # Overwrite existing files | 覆盖现有文件 --fresh-install # Setup on new machine | 在新机器上设置 ```
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation claims encryption, cloud backends, sync, and selective restore that static analysis says are not actually implemented, while also implying handling of credentials and full configuration backup. This can cause users to trust protections or data flows that do not exist, leading to accidental exposure of secrets or incomplete recovery when the skill is used in real migrations or backups.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill explicitly supports overwriting existing files during restore, which is a self-modification capability affecting local OpenClaw configuration and potentially other workspace content. In the context of restore from backup, this is expected functionality, but it is still dangerous because a malicious or tampered backup could replace trusted configuration, installed skills, or persisted state.
- Content
md Options: --backup PATH Backup file to restore from --selective Choose what to restore --overwrite Overwrite existing files --merge Merge with existing configuration --fresh-install Setup on new machine --dry-run Preview changes
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The tool advertises encryption support via the --encrypt flag, but the implementation only prints that encryption is not yet implemented and still creates a plaintext ZIP containing highly sensitive OpenClaw data such as credentials, memory, settings, and possibly history. Users may rely on the flag for confidentiality and then store or transmit backups insecurely, causing credential and data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly advertises backup of credentials, conversation history, and optionally workspace data, but it does not provide prominent warnings about the sensitivity of those contents, secure handling requirements, or restore-side overwrite/privacy risks. In a backup/migration skill, this omission can lead users to package secrets and private data into portable archives and move them to less trusted storage backends such as cloud or Git repositories.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises backup, restore, credential handling, and environment-variable-based encryption workflows, but the manifest declares no explicit tool scope or permissions. For a skill that accesses highly sensitive local configuration, memory, history, and credentials, missing scope declarations reduce user visibility and weaken least-privilege controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill prominently promotes backing up skills, memory, history, workspace, and credentials, and mentions cloud destinations, but does not provide a clear warning that these backups can contain highly sensitive data. Users may upload or share backups without understanding that they may include secrets, private conversations, and local project data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill advertises cloud/network storage and team-sharing style capabilities without corresponding declared runtime requirements or clear operational boundaries. This is risky because users may assume safe, supported remote export of extremely sensitive backups containing memory, history, and credentials.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Creating backups of skills, memory, settings, history, and credentials is a form of persistence because it preserves and duplicates sensitive session and configuration state. In a backup skill this is contextually expected, but it increases risk if stored insecurely, transferred off-device, or restored later without validation.
- Content
Quick Start
Create backup
bash # Full backup with encryption python3 ~/.openclaw/workspace/clawsync/scripts/clawsync.py backup --encrypt
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The restore workflow documents overwrite and merge behavior without a strong warning that local configuration, skills, memory, or workspace files may be replaced or modified. This can lead to destructive changes, accidental rollback, or reintroduction of unsafe content from an untrusted backup.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
Automated daily backups increase persistence by continuously capturing evolving OpenClaw state, including potentially sensitive configuration and user history over time. This is legitimate backup behavior, but scheduled retention of sensitive archives expands exposure if the backup location is compromised.
- Content
--output ~/migration_backup.zip
text Output: Encrypted ZIP with everything needed to recreate setup. ### Example 2: Daily Auto-Backup ```bash
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The backup routine includes sensitive material such as credentials by default in non-quick backups, and can also include history and workspace data, without a strong user-facing warning at backup time. In the context of a migration/backup skill, this increases the chance users will create archives containing secrets and private conversational data, especially dangerous given the separate lack of actual encryption support.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest states the skill supports 'selective restore', and the CLI accepts a '--selective' flag. In practice, the 'selective' parameter is never used in restore_backup, and the code iterates through all archive entries for extraction, so the implemented behavior is full restore rather than selective restore.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The restore path extracts archive contents into the target OpenClaw directory, which changes user files and may overwrite data when the overwrite flag is used. Although a dry-run mode exists and success/error messages are printed after the fact, there is no up-front confirmation prompt or clear warning describing the impact of restoration.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The documentation promises password encryption, GPG support, and secure deletion, but the manifest declares only
python3under required binaries. Because GPG and secure wipe tooling are described as core features while not being represented in the manifest requirements, the stated behavior does not cleanly match the skill's declared implementation surface.- Content