workspace-backup-github

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:50 AM UTC
• Version: 1.3.0

Overview

This backup skill is purpose-aligned, but it handles GitHub tokens and sensitive workspace data in ways users should review carefully before installing.

Install only if you are comfortable sending agent memory, identity, user, tool, and skill files to a private GitHub repository. Do not paste broad GitHub tokens into chat; use a fine-grained token or safer credential helper, review every staged file before pushing, and restore only from a verified commit into a staging directory first.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:35

Finding

Sensitive workspace data may be committed and uploaded without secret scanning

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh:35; SKILL.md:33-41; SKILL.md:164-166
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

The backup process explicitly stages files and directories likely to contain personal information, credentials, operational configuration, agent instructions, and conversation-derived memory. This behavior conflicts with the documentation's assurance that credentials and other sensitive data are not backed up.

Relevant code:

bash

git add AGENTS.md SOUL.md USER.md IDENTITY.md TOOLS.md HEARTBEAT.md README.md SYNC.md .gitignore skills/ memory/ 2>/dev/null

Contradictory security claims:

text

- Sensitive data (API keys, passwords) are NOT backed up
- Backup archive contains no credentials

Technical Analysis

The script applies no content inspection, secret scanning, redaction, or validation before committing the selected files. Files such as TOOLS.md, USER.md, memory/, and installed skills can contain API keys, authentication instructions, personal information, private conversations, endpoint details, or other sensitive operational data.

A .gitignore file is not an adequate security boundary. It does not prevent explicitly named files from being staged, and it does not protect sensitive content in files that Git already tracks. Once committed and pushed, deleting a secret from the latest revision does not remove it from Git history.

The destination being a private repository reduces public exposure but does not prevent access by repository collaborators, compromised GitHub accounts, stolen tokens, integrations, or future repository visibility changes.

Attack Path

1. A credential, private user detail, or sensitive agent state is written to TOOLS.md, USER.md, memory/, a skill file, or another selected path.
2. The backup script executes the broad git add command.
3. The sensitive file is s ...[truncated 959 chars]

Remediation

View remediation

Remediation Suggestions

1. Run a reputable secret scanner against staged content before every commit and abort the backup if credentials or high-entropy secrets are detected.
2. Use a minimal, explicitly reviewed allowlist rather than backing up broad directories.
3. Exclude memory/, USER.md, TOOLS.md, and identity or instruction files by default, requiring informed opt-in for each sensitive category.
4. Inspect the staged file list with git diff --cached --name-only and the staged content with git diff --cached before committing.
5. Verify through the GitHub API that the destination repository is private before uploading any content.
6. Warn users that private repositories and .gitignore do not guarantee that credentials are absent.
7. Provide documented procedures for revoking exposed credentials and purging sensitive files from all Git history.
8. Consider client-side encryption with separately managed keys for backups containing private agent state.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:5

Finding

Broad GitHub token is exposed through command-line arguments and the Git remote URL

Content

View full analysis

Vulnerability Details

File Location: scripts/backup.sh:5-7; scripts/backup.sh:26-32; SKILL.md:73-80; SKILL.md:139; SKILL.md:162
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

The script receives a GitHub token as a positional command-line argument and embeds it directly in the persistent Git remote URL.

Relevant code:

bash

GITHUB_USER="${1}"
REPO_NAME="${2}"
TOKEN="${3}"

bash

CURRENT_REMOTE=$(git remote get-url origin 2>/dev/null || echo "")
EXPECTED_REMOTE="https://x-access-token:${TOKEN}@github.com/${GITHUB_USER}/${REPO_NAME}.git"

if [ "$CURRENT_REMOTE" != "$EXPECTED_REMOTE" ]; then
    git remote set-url origin "$EXPECTED_REMOTE" 2>/dev/null || \
    git remote add origin "$EXPECTED_REMOTE"
fi

The setup instructions also request a classic token with broad repository access:

text

Check the `repo` permission (full control of private repositories)

Technical Analysis

Command-line arguments can be exposed through shell history, process inspection facilities, task runners, diagnostic output, audit telemetry, or orchestration logs. Passing a secret as the third positional argument therefore creates an avoidable disclosure channel.

Embedding the token in the remote URL persists it in the repository's .git/config. Any local user or process able to read that file can recover the plaintext credential. Commands such as git remote -v can also display the credential, and the project documentation explicitly recommends that command for troubleshooting.

The requested classic repo scope can grant access to multiple private repositories associated with the user rather than only the intended backup repository. Consequently, compromise of this token may affect resources unrelated to the backup task.

Attack Path

1. The user invokes backup.sh and supplies the GitHub token as the third argument.
2. A local process, shell ...[truncated 1152 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept authentication tokens as command-line arguments.
2. Use a supported Git credential helper, GitHub CLI authentication, an operating-system secret store, or a protected ephemeral credential file.
3. Store a token-free remote URL such as https://github.com/user/repository.git.
4. Use a fine-grained GitHub personal access token restricted to the single backup repository and only the minimum required content permissions.
5. Ensure any temporary credential material is created with restrictive permissions, removed reliably, and never written to logs.
6. Avoid printing authenticated URLs and redact credentials from troubleshooting output.
7. Remove existing token-bearing URLs from .git/config, shell history, logs, cron definitions, and agent transcripts.
8. Revoke and rotate any token that has already been used with the current implementation.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:187

Finding

Unverified repository content can poison persistent agent state during restoration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:187-195
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

The documented recovery procedure clones a repository and directly copies its contents into the active OpenClaw workspace without verifying the selected revision, commit signature, file types, or changes to security-sensitive agent state.

Relevant code:

bash

# 1. Clone the backup repo
git clone https://github.com/[username]/[repo].git /tmp/restore

# 2. Restore files
cp -r /tmp/restore/* ~/.openclaw/workspace/

# 3. Reconfigure environment variables
# (sensitive info not in backup)

Technical Analysis

The backup includes persistent agent instruction and state files such as AGENTS.md, SOUL.md, IDENTITY.md, TOOLS.md, memory/, and skills/. The restore procedure treats all repository content as trusted and places it directly in the live workspace.

No commit pinning, signature verification, checksum validation, diff review, file allowlist, symlink rejection, or staging-area inspection is required. If the repository or an authorized GitHub credential is compromised, an attacker can modify persistent memory, agent instructions, tool configuration, or installed skill code. Those changes can affect subsequent sessions after restoration.

Because this procedure uses the repository's current default branch, the effective restored content may change after the backup skill itself was reviewed.

Attack Path

1. An attacker obtains write access to the backup repository, compromises an authorized GitHub account or token, or persuades the user to restore from an attacker-controlled repository.
2. The attacker modifies persistent files such as AGENTS.md, SOUL.md, TOOLS.md, files under memory/, or scripts under skills/.
3. The user follows the documented recovery procedure.
4. Git clones the attacker's current repository content without pinning a known-good c ...[truncated 960 chars]

Remediation

View remediation

Remediation Suggestions

1. Restore into a newly created staging directory rather than directly into the active workspace.
2. Require the user to select and verify a known-good commit hash instead of restoring the current default branch implicitly.
3. Require cryptographically signed commits or tags from trusted identities and verify them before restoration.
4. Display a complete diff and obtain explicit approval before replacing AGENTS.md, SOUL.md, IDENTITY.md, TOOLS.md, memory, or skills.
5. Apply a strict file allowlist and reject unexpected executables, device files, hard links, and symbolic links.
6. Validate ownership and permissions before activating restored files.
7. Restore executable skills separately and subject them to code review before installation.
8. Preserve the existing workspace as a rollback snapshot and activate restored state only after validation succeeds.
9. Use a non-root service account for OpenClaw so compromised workspace instructions or code cannot inherit unnecessary system privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill advertises safe, one-click private backup behavior, but the documented behavior includes sensitive token handling via remote URLs and only a partial file selection while implying broader protection. This mismatch is dangerous because users may trust the skill with secrets and workspace data under inaccurate assumptions, leading to credential exposure or incomplete backups when recovery is needed.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented backup scope includes memory, user, identity, agent, and tool configuration files that are likely to contain personal data, operational context, prompts, or secrets. Sending these files to GitHub, even a private repository, creates a substantial confidentiality risk because private repos can still be exposed through token compromise, misconfiguration, or later sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The setup flow instructs the user to paste a GitHub personal access token directly into chat, which is a plain-text credential collection pattern. Chat transcripts, logs, model providers, or downstream integrations may retain that token, enabling repository compromise and potentially broader account abuse depending on token scope.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Asking the user to paste a GitHub access token into the conversation directly solicits a secret in plain language, which is inherently unsafe. The context makes this more dangerous because the token is intended to grant repository control, so exposure can lead to immediate unauthorized access and persistent compromise of backups.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manual backup command explicitly stages and pushes memory, user, identity, and related workspace files to GitHub, creating a direct path for sensitive data exfiltration. The skill context increases severity because these files are likely to contain conversational history, personal information, agent instructions, or operational secrets that users may not expect to leave the local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Broad trigger keywords like 'backup', 'git backup', and 'sync to github' are likely to match ordinary conversation and may invoke the skill unexpectedly. In a skill that handles secrets and pushes local data to a remote repository, accidental activation materially increases the chance of unintended disclosure or unauthorized actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation section defines multiple ambiguous triggers without scope boundaries, increasing the chance that normal discussion of backups or GitHub causes activation. Because this skill can collect a token and exfiltrate local workspace data to a third-party service, ambiguity in invocation is meaningfully dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states it activates when a user or agent says a trigger phrase, allowing autonomous invocation by another agent rather than only by the end user. In a data backup skill, this could let another automated component initiate collection, scheduling, or transmission of sensitive workspace content without meaningful user consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The security notes claim the backup contains no credentials, but the documented backup set includes files like USER.md, IDENTITY.md, memory/, and other workspace artifacts that may contain secrets or highly sensitive personal/context data. Misleading safety claims can cause users to back up confidential information to GitHub without appropriate review or redaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script embeds the GitHub token directly into the remote URL, which can expose credentials through shell history, process listings, git configuration, logs, or accidental display via git remote -v. In the context of a backup skill that targets agent workspaces and is likely run unattended, this creates a realistic risk of credential leakage and unauthorized repository access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script stages a broad set of files and directories and then pushes them to a remote GitHub repository. While backup is implied by the script name, there is no explicit warning or confirmation that local workspace data will be transmitted off-system to a remote service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description consistently frames the skill as a GitHub backup tool with setup and scheduled backup workflows. However, the usage section and recovery guide also instruct users to restore from GitHub and copy repository contents back into the workspace, which expands the described behavior beyond backup into recovery and overwrite operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script's usage strings are presented only in Chinese, which imposes a language choice on users without opt-in or explanation. Under the policy, locale-specific language should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.