Security audit

Openclaw Backup

Security checks across malware telemetry and agentic risk

Overview

This is a real backup tool, but it needs review because some workflows can upload sensitive backup material, run restored scripts, and delete old backups without enough safeguards.

Install only after reviewing the scripts and deciding you are comfortable with local filesystem mutation, cron persistence, and GitHub upload behavior. Before using GitHub push, verify the repository is private and confirm whether an encrypted secrets archive will be included. Treat operational backups as sensitive because they include workspace memory, prompts, scripts, and skills. Run restore with --dry-run first, avoid --force unless you are in a controlled recovery procedure, and do not restore untrusted archives without inspecting or disabling the restored health-check script.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation instructs use of shell scripts that read and write files, perform restores, and schedule recurring jobs, but it declares no permissions. That mismatch can cause users or platforms to underestimate the skill's ability to modify the filesystem and execute commands, which is especially risky for backup/restore tooling because it can overwrite live state, create cron jobs, and move sensitive data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The stated description emphasizes backup, restore, verification, and GitHub push protections, but the file also advertises retention pruning, orphan cleanup, restore drills, and pre-change snapshots. These additional behaviors include deletion and recurring maintenance actions that materially expand risk, because users may invoke or install the skill without realizing it can remove historical backups or perform broader operational changes.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The restore flow executes a shell script taken directly from the restored backup contents (`workspace/scripts/pre-restart-check.sh`). Even though the archive is checksum-verified, that only proves integrity relative to the manifest, not trustworthiness; a malicious or compromised backup can therefore run arbitrary code during restore with the privileges of the restoring user. In a disaster-recovery skill, users are especially likely to restore archives from external or older sources, which increases the danger.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This script is presented as a weekly verification job, but it also performs retention pruning and orphan cleanup with `rm -rf`/`rm -f`. That coupling is dangerous because a routine integrity-check task can unexpectedly destroy backup data, and any mistake in timestamp parsing, retention logic, or path selection would turn a verify run into irreversible data loss.

Intent-Code Divergence

Low

Confidence: 74% confidence
Finding: The final status output says only 'Weekly backup verify' even though the script also prunes runs and removes orphaned files. This misleading labeling can cause operators or automation to invoke it as a harmless health check, increasing the chance of unintended deletions during routine maintenance.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script performs multiple destructive deletions automatically and without any user-facing warning, confirmation, or dry-run mode. In a disaster-recovery context, silent deletion is risky because backup sets are high-value assets; an operator, scheduler, or compromised environment variable could trigger irreversible cleanup before issues are noticed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.