绿联NAS OpenClaw备份

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:49 AM UTC
• Version: 1.0.4

Overview

This backup skill is coherent, but its restore instructions use broad root-level archive extraction without validation and its backups may expose sensitive OpenClaw data.

Review before installing. Use this only for the intended Ugreen NAS OpenClaw deployment, store backups in a private protected location, consider encrypting them, and do not restore an archive unless you trust its source. A safer restore should inspect the archive first, validate that all entries stay under .openclaw, stage extraction in a temporary directory, and keep a fresh rollback backup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55

Finding

Unencrypted Backup May Expose Sensitive OpenClaw Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-57; related backup-content declaration at lines 115-119
Vulnerability Type: Sensitive data stored in an unprotected archive
Risk Level: Medium

Vulnerable Code:

bash

# Execute backup
cd "$OPENCLAW_DIR"
tar -czf "$BACKUP_DIR/openclaw-backup-$(date +%Y%m%d-%H%M%S).tar.gz" .openclaw/

The documented backup contents include:

text

- `~/.openclaw/` — All config and data
- `~/.openclaw/workspace/` — Workspace and skills
- `~/.openclaw/openclaw.json` — Main config file

Technical Analysis

The Skill instructs the agent to place the complete OpenClaw data directory into a gzip-compressed tar archive. Compression does not provide confidentiality or integrity. The command neither encrypts the archive nor explicitly establishes restrictive permissions through a secure umask.

The destination is an automatically inferred writable directory or a user-provided path. Such a path may be a NAS share, shared mount, or directory with permissions broader than intended. Because the backup covers all configuration and data, it may contain authentication tokens, credentials, private configuration, conversation data, installed Skills, or other sensitive workspace files.

An additional correctness defect exists in the shown command: after changing into "$OPENCLAW_DIR"—documented as /root/.openclaw—the archive operand .openclaw/ refers to /root/.openclaw/.openclaw/. This likely causes backup failure unless that nested directory exists. Although this defect is not itself a security vulnerability, it can create a false expectation that a valid backup was produced.

Attack Path

1. A backup is created in an automatically inferred or manually selected directory.
2. The destination is accessible to another NAS user, service, container, or process because it is shared or has permissive directory permissions.
3. The archive inherits permissi ...[truncated 727 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive process mask before creating the archive:

   bash

   umask 077
   

2. Create the archive with a temporary name, verify successful completion, explicitly set mode 0600, and then rename it atomically.

3. Verify that the destination is owned by the expected user and is not writable or readable by unintended users, groups, containers, or network-share clients.

4. Warn users not to store backups in public or broadly shared NAS directories.

5. Protect backup confidentiality and integrity with authenticated encryption, such as age, GPG, or another approved backup-encryption mechanism.

6. Exclude secrets that are unnecessary for restoration, or store them using a separate secret-management and recovery process.

7. Correct the archive source path. For example:

   bash

   umask 077
   cd /root
   tar -czf "$BACKUP_DIR/openclaw-backup-$(date +%Y%m%d-%H%M%S).tar.gz" .openclaw/
   chmod 600 "$BACKUP_DIR"/openclaw-backup-*.tar.gz
   

8. Verify archive readability and expected contents after creation, and clearly report any backup failure.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:78

Finding

Untrusted Archive Is Extracted into the Root Home Directory Without Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78-96
Vulnerability Type: Unsafe privileged archive extraction
Risk Level: High

Vulnerable Code:

bash

# 1. Find backup directory
BACKUP_DIR=$(auto-detect)

# 2. List available backups
ls -lt "$BACKUP_DIR"/openclaw-backup-*.tar.gz

# 3. Let user select
# User selects: openclaw-backup-20260317-143022.tar.gz

# 4. Confirm restore
# Warning: Restore will overwrite existing config, continue? (y/n)

# 5. Execute restore (recommend stopping OpenClaw first)
cd /root
tar -xzf "$BACKUP_DIR/openclaw-backup-20260317-143022.tar.gz"

# 6. Restart OpenClaw container

Technical Analysis

The restoration procedure trusts an archive based only on its location and filename pattern. It does not verify archive ownership, file permissions, provenance, a cryptographic signature, or an authenticated digest. It also does not inspect and constrain archive members before extraction.

Extracting an untrusted tar archive can be dangerous when it contains absolute paths, .. traversal components, symbolic or hard links, special files, or members outside the expected .openclaw subtree. Tar implementations provide some default protections, but the Skill must not rely exclusively on implementation-specific behavior, especially when extracting under a privileged account.

The command changes to /root before extraction. If the agent runs as root—as the documented paths imply—a malicious archive could overwrite root-owned files. A confirmation prompt only warns that existing configuration will be overwritten; it does not establish that the selected archive is authentic or structurally safe.

Attack Path

1. An attacker obtains write access to the detected backup directory or compromises a process, user account, container, or network share that can modify it.
2. The attacker creates or replaces a file matching openclaw-backup-*.tar.gz.
3. The maliciou ...[truncated 1383 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every backup archive as untrusted until its provenance and integrity have been verified.
2. Store an authenticated manifest or digital signature when creating each backup and verify it before restoration.
3. Verify that the archive and its parent directories are owned by the expected account and are not writable by unauthorized users or services.
4. List and validate every member before extraction. Reject:
   • Absolute paths
   • Empty or malformed names
   • Any .. path component
   • Members outside the expected .openclaw/ prefix
   • Symbolic links and hard links
   • Device nodes, FIFOs, and other special files
5. Extract into a newly created, permission-restricted staging directory rather than directly into /root.
6. Perform validation again after extraction without following links, then copy only approved regular files into the destination.
7. Use least privilege for restoration. Elevate privileges only for narrowly scoped operations that genuinely require them.
8. Avoid preserving archive-supplied ownership and permissions unless explicitly required. Apply known-safe ownership and modes during installation.
9. Make the restore process transactional: stop OpenClaw, preserve the current state, stage and validate the replacement, atomically activate it, and support rollback.
10. Display verified archive identity, creation time, signer, and digest during confirmation rather than relying only on the filename.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The restore flow extracts a selected archive into /root and explicitly overwrites existing OpenClaw configuration. Even with a warning, this is a real self-modifying action that can destroy current state, replace skills or settings, and potentially reintroduce unsafe content from backups if the wrong archive is chosen.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

# 用户选择: openclaw-backup-20260317-143022.tar.gz / User selects: openclaw-backup-20260317-143022.tar.gz

# 4. 确认恢复 / Confirm restore
# 警告：恢复会覆盖现有配置，是否继续？(y/n) / Warning: Restore will overwrite existing config, continue? (y/n)

# 5. 执行恢复（建议先停止 OpenClaw）/ Execute restore (recommend stopping OpenClaw first)
cd /root

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

This note confirms that restore operations overwrite the current configuration, which is a destructive state-changing capability. In context this is expected functionality, but it still carries real risk of accidental loss of data or reapplication of unwanted prior state.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

恢复注意事项 / Restore Notes

• ⚠️ 恢复会覆盖现有配置，请提前确认 / Restore will overwrite existing config, please confirm in advance
• 建议恢复前停止 OpenClaw 容器 / Recommend stopping OpenClaw container before restore
• 如果只是想查看备份内容，可以不解压直接查看 / If only need to view backup content, can view without extracting:

  bash

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad and generic, such as backup, snapshot, export, and restore, without clearly constraining them to OpenClaw on Ugreen NAS. This can cause the skill to activate for unrelated user requests and then suggest backup or restore operations that affect the wrong environment or data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

用户要求 / User requests:
- "备份 OpenClaw" / "Backup OpenClaw"
- "创建快照" / "Create snapshot"
- "备份部署" / "Backup deployment"
- "导出配置" / "Export configuration"
- "恢复备份" / "Restore backup"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The backup contents include the entire ~/.openclaw directory, workspace, skills, and configuration, but the skill does not prominently warn that archives may contain sensitive user data, credentials, or proprietary skills. A user could create or move backups insecurely without understanding the privacy and data exposure implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The line says "MiLe will ask you" in Chinese, which suggests the interaction may be presented in Chinese by default. While the document is bilingual overall, this specific instruction does not indicate that the user can choose their preferred language or locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.