Skills/ClawHub/openclaw-webdav-backup

openclaw-webdav-backup@1.3.0

CAUTION· static only

Publisher claims: "Backup and restore an OpenClaw workspace with incremental backups, integrity verification, health checks, optional config encryption and optional WebDAV uplo..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher ifox2046 · publishing for 165 daysInstalls 1,200Last detonated 5 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 45/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Privileged sudo command. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsscripts/openclaw-backup-notify.impl.sh:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesNOTIFY_ENV_FILE="${WORKSPACE_DIR}/.env.backup.notify"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-export.impl.sh:231 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 编辑 .env 文件，填入你的配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandSKILL.md:189 · Privileged sudo command — agent may execute with elevated privilegessudo yum install pigz zstdFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:183 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install pigz zstdFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsSKILL.md:211 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. Edit `.env.backup.notify` with your channel settings:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesPrepare `.env.backup` with the user's own WebDAV settings, then run:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-export.impl.sh:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Copy this file to .env and fill in your valuesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Telegram Bot API URLscripts/openclaw-backup-notify.impl.sh:88 · Telegram Bot API URL — data will be sent to Telegram-X POST "https://api.telegram.org/bot${BACKUP_NOTIFY_TELEGRAM_BOT_TOKEN}/sendMessage" \Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsSKILL.md:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| Notification send fails (Telegram/WeCom/Feishu) | Check network, verify token/key in `.env.backup.notify` | Log failure locally and continue; backup itself is not affected |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-export.impl.sh:230 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp migrate.env.template .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-backup.impl.sh:273 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(cd "${source_dir}" && tar --exclude='node_modules' --exclude='.git' --exclude='backups/openclaw' --exclude='.env.backup' --exclude='.env.backup.secret' \Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedlib/cleanup.sh:39 · Destructive file system command detectedrm -f /tmp/webdav_error_$$.txt 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-backup.impl.sh:278 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(cd "${source_dir}" && tar --exclude='node_modules' --exclude='.git' --exclude='backups/openclaw' --exclude='.env.backup' --exclude='.env.backup.secret' \Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Prompting user to enter sensitive credentialsSKILL.md:281 · Prompting user to enter sensitive credentials — social engineering- for encrypted backups, `.env.backup.secret` and the password are **either/or**: either keep the file, or remember/provide the passwordFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsscripts/openclaw-backup.impl.sh:262 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(cd "${source_dir}" && tar --exclude='node_modules' --exclude='.git' --exclude='backups/openclaw' --exclude='.env.backup' --exclude='.env.backup.secret' \Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| WebDAV upload fails (curl error) | Retry with `--retry 3`, verify `.env.backup` credentials | Fall back to local-only backup, notify user with error details |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:208 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp references/env.backup.notify.example .env.backup.notifyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-export.impl.sh:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="${OPENCLAW_HOME}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:259 · File type combined with upload action — agent may exfiltrate local data files| Upload unencrypted `openclaw.json` to remote | Contains API keys, tokens, and secrets | Always use `--encrypt-config` before `--upload` |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandscripts/openclaw-export.impl.sh:616 · File permission modification command — agent changes file ownership/permissionschmod +x "${output_dir}/scripts/check-compatibility.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-restore.impl.sh:557 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSECRET_FILE="${OPENCLAW_WORKSPACE_DIR}/.env.backup.secret"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-restore.impl.sh:560 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="${BASE_DIR}/.env.backup"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-healthcheck.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSECRET_FILE="${WORKSPACE_DIR}/.env.backup.secret"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-restore.impl.sh:556 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="${OPENCLAW_WORKSPACE_DIR}/.env.backup"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-export.impl.sh:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesnano .env # 或 vim/codeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-restore.impl.sh:584 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Missing BACKUP_ENCRYPT_PASS. Set env var, provide .env.backup.secret, or run interactively." >&2Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-restore.impl.sh:561 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSECRET_FILE="${BASE_DIR}/.env.backup.secret"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/openclaw-healthcheck.sh:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="${WORKSPACE_DIR}/.env.backup"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/openclaw-export.impl.sh:486 · File permission modification command — agent changes file ownership/permissionschmod +x "${output_dir}/scripts/migrate.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈3,719 tok
1 file · 23 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim ifox2046: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Telegram Bot API URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Prompting user to enter sensitive credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ifox2046Propose a patch to the maintainer