gitclaw

ISSUES FOUND max severity HIGHSkillSpector Do not install 100 registry clawhub.ai last scanned 1 scan

5 findings (2 high, 3 medium), mainly command injection, resource abuse, data exfiltration. Most recent scan 2026-02-06.

This skill presents HIGH security risks due to unrestricted sudo command execution, automated system modifications, and silent background operations. While the functionality (GitHub backup) is legitimate, the implementation bypasses user oversight for privileged operations by design ('do everything automatically and quietly'). The skill installs packages, modifies system services, creates cron jobs, and pushes data to GitHub with minimal user interaction after initial setup. The missing allowed-tools declaration and incomplete description further obscure the skill's true system impact. Recommended actions: Require explicit confirmation for all sudo operations, add allowed-tools restrictions, improve transparency about system modifications, and implement safeguards against sensitive data exposure.

Scanner's overall assessment (LLM analyzer)
Findings5
Critical0
High2
Medium3
Low0
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100
Score100 / 100
Issues68
CategoriesPrivilege Escalation Tool Misuse Rogue Agent
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Back up the OpenClaw agent workspace to a GitHub repo and keep it synced via a cron-driven commit/push script.

Package
1 file, 10 KB
SKILL.md
1425 words, 12+ sections
Code
None. Instructions only.
Homepage
https://gitclaw.ai

SKILL.md covers: GitClaw: Agent self-backup to GitHub · When to use · Behavioral rule (important) · Inputs to ask the user for · Step 1: Ensure prerequisites (auto-install) · 1A) Ensure git is installed (auto-install; do not stop) · 1B) Ensure cron/crontab is available (best-effort auto-install) · Step 2: Ensure GitHub CLI (`gh`) is installed (auto-install) · Step 3: Ensure the user is authenticated in `gh` (agent runs the flow) · Step 4: Initialize git in the OpenClaw workspace and connect/create the repo · Step 5: Install deterministic backup script (NO AI / NO heartbeat) · GitClaw deterministic backup (no AI)

Findings

HIGH Unrestricted Command Execution with sudo Privileges Command Injectionllm

The skill executes numerous system commands with sudo privileges (apt-get, dnf, yum, pacman, zypper, apk, systemctl, service) without user confirmation or validation. This allows arbitrary package installation and system service manipulation. The instructions explicitly state 'Do everything automatically and quietly' which bypasses user oversight for privileged operations.

SKILL.md

sudo apt-get update && sudo apt-get install -y git, sudo systemctl enable --now cron, sudo dnf install -y cronie, sudo yum install -y cronie, sudo pacman -S --noconfirm cronie, sudo apk add dcron, sudo rc-update add dcron default
Remediation: Require explicit user confirmation before executing any sudo commands. Implement a whitelist of allowed package managers and commands. Add validation to ensure commands are only executed when necessary. Remove the 'automatically and quietly' directive for privileged operations.
HIGH Automated Cron Job Installation Without User Control Resource Abusellm

The skill automatically installs and configures cron jobs that will execute git operations periodically (default every 60 minutes) without clear user visibility or easy removal mechanism. The 'do everything automatically and quietly' directive means users may not be aware of background processes consuming resources and making network calls.

SKILL.md

Backup frequency in minutes (default: 60), Do everything automatically and quietly, Only message the user when you need inputs or operations fail
Remediation: Require explicit user confirmation before installing cron jobs. Provide clear documentation on how to view, modify, or remove the cron job. Display the cron schedule to the user before installation. Implement a mechanism for users to easily disable the automation.
MEDIUM Automated GitHub Repository Creation and Data Upload Data Exfiltrationllm

The skill automatically creates GitHub repositories (public or private) and pushes workspace data without explicit per-operation user confirmation. While it asks for initial repository settings, subsequent automated commits and pushes happen silently. This could lead to unintended data exposure, especially if sensitive files are in the workspace.

SKILL.md

back up / sync / mirror the OpenClaw workspace, set up periodic commits and pushes, Do everything automatically and quietly
Remediation: Implement .gitignore validation to prevent sensitive file uploads. Warn users about potential sensitive data in workspace before first push. Require confirmation for public repository creation. Provide clear documentation about what data will be backed up. Consider implementing a dry-run mode showing what would be committed.
MEDIUM Missing allowed-tools Declaration with Extensive System Modifications Unauthorized Tool Usellm

The skill performs extensive system operations (package installation, service management, cron configuration, git operations, GitHub API calls) but does not declare any allowed-tools restrictions in the manifest. This makes it impossible for users or the agent to validate that the skill's operations are within expected boundaries.

SKILL.md

allowed-tools: Not specified, but skill executes: sudo commands, package managers (apt-get, dnf, yum, pacman, zypper, apk, brew), systemctl/service commands, crontab modifications, git operations, gh CLI operations
Remediation: Add allowed-tools declaration specifying [Bash, Python] at minimum. Document all system-level operations in the description. Consider splitting functionality into separate skills with more limited scope (e.g., one for setup, one for sync operations).
MEDIUM Incomplete Description Masks Privileged System Operations Social Engineeringllm

The skill description states it will 'back up the OpenClaw agent workspace to a GitHub repo' but does not disclose that it will automatically install system packages with sudo, modify system services (cron), or execute privileged commands. This is misleading about the skill's actual scope and system impact.

SKILL.md

description: Back up the OpenClaw agent workspace to a GitHub repo and keep it synced via a cron-driven commit/push script. (Does not mention: sudo operations, package installation, system service modification, automated background processes)
Remediation: Update description to explicitly state: 'Installs git, GitHub CLI, and cron if needed (requires sudo). Configures automated background sync via cron. Modifies system services.' Add a security notice about privileged operations.

What is in the package

FileKindSize
SKILL.mddoc10 KB

External hosts referenced

cli.github.com github.com gitclaw.ai

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

WORKSPACE_DIR REMOTE_URL STATE_DIR LOCK_DIR

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills