myclaw-backup
Warn
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill is designed to archive and restore sensitive files including 'openclaw.json' and the 'credentials' directory, which contain API keys, bot tokens, and channel pairing states.
- [COMMAND_EXECUTION]: The 'server.js' script uses 'child_process.execSync' to run shell scripts. Additionally, 'schedule.sh' modifies the system crontab to enable persistence for the backup task.
- [DATA_EXFILTRATION]: The skill starts an HTTP server on port 7373 to allow downloading backup archives. This provides a networked path for sensitive data such as API keys and session history to leave the system.
- [REMOTE_CODE_EXECUTION]: The restoration process overwrites system scripts like 'guardian.sh' with files from an uploaded archive. This could allow an attacker with server access to replace legitimate scripts with malicious code.
Audit Metadata