openclaw-checkpoint
3 findings (2 high, 1 medium), mainly command injection, data exfiltration, unauthorized tool use. Most recent scan 2026-02-06.
This skill presents SIGNIFICANT SECURITY RISKS that require immediate attention before use. The primary concerns are: (1) Remote code execution via unverified curl|bash installation, (2) Potential credential exposure through git repository syncing without verifiable safeguards, (3) Missing security-critical implementation files preventing verification of security claims, and (4) Incomplete documentation that obscures actual behavior. The skill's core functionality—syncing workspace state to remote repositories—is inherently sensitive and requires robust security measures. However, critical implementation files (secure.py, backup.py, 1Password.py) are missing, making it impossible to verify the claimed protections against credential leakage. The installation method using curl|bash is a well-known security anti-pattern. The incomplete documentation (truncated command descriptions, missing referenced files) further undermines confidence in the skill's security posture. While the concept of workspace backup is valuable, this implementation requires significant security improvements and complete documentation before it can be safely recommended for use.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Backup and restore OpenClaw workspace state across machines using git. Enables disaster recovery by syncing SOUL.md, MEMORY.md, memory files, and configuration to a remote repository. Use when user wants to checkpoint their OpenClaw state, restore on a new machine, migrate between computers, or protect against data loss. Provides commands checkpoint-setup (interactive onboarding), checkpoint, checkpoint-resume, checkpoint-schedule (auto-backup), checkpoint-stop, checkpoint-status, checkpoint-init, and checkpoint-reset.
- Package
- 3 files, 19 KB
- SKILL.md
- 1727 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: OpenClaw Checkpoint Skill · Overview · Installation · Option 1: One-Liner Install (Recommended) · Option 2: Manual Install · Clone the skill repo · Copy scripts to tools directory · Add to PATH (also add to ~/.zshrc or ~/.bashrc for persistence) · Run setup wizard · Commands · checkpoint-setup · checkpoint-auth
Findings
HIGH Remote Code Execution via Unverified Install Script Command Injectionllm
The skill instructs users to execute a remote shell script directly from GitHub using curl piped to bash without any verification. This is a critical security anti-pattern that allows arbitrary code execution on the user's machine. The script at 'https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh' could be modified by an attacker (if the repository is compromised) or could contain malicious code. Users are encouraged to run this with elevated privileges during installation.
SKILL.md
curl -fsSL https://raw.githubusercontent.com/AnthonyFrancis/openclaw-checkpoint/main/scripts/install-openclaw-checkpoint.sh | bashHIGH Potential Credential and Sensitive Data Exposure via Git Repository Data Exfiltrationllm
The skill syncs the entire OpenClaw workspace to a remote git repository, including SOUL.md, MEMORY.md, conversation history, and custom scripts. While the description claims API keys and credentials are 'not synced', there is no verification mechanism shown. The instruction body is incomplete (cuts off mid-sentence in 'checkpoint' command description), and multiple referenced security-critical files (secure.py, backup.py, 1Password.py) are missing, making it impossible to verify what data protection measures are actually implemented. Users may inadvertently commit sensitive information in memory files, conversation logs, or custom scripts.
SKILL.md
This skill provides disaster recovery for OpenClaw by syncing your workspace to a git repository. It preserves: Identity, Memory, Configuration, Scripts. **Not synced** (security): API keys (.env.*), credentials, OAuth tokens - but no implementation details providedMEDIUM Unauthorized Tool Installation and PATH Modification Unauthorized Tool Usellm
The installation process automatically copies executable scripts to ~/.openclaw/workspace/tools/ and modifies the user's PATH environment variable without explicit permission or security review. The scripts (checkpoint, checkpoint-setup, checkpoint-auth, etc.) are made executable and added to PATH, allowing them to be invoked from anywhere. This could enable tool shadowing attacks if malicious scripts with common names are installed, or if the installation is compromised.
SKILL.md
cp ~/.openclaw/skills/openclaw-checkpoint/scripts/checkpoint* ~/.openclaw/workspace/tools/
chmod +x ~/.openclaw/workspace/tools/checkpoint*
export PATH="${HOME}/.openclaw/workspace/tools:${PATH}"What is in the package
| File | Kind | Size |
|---|---|---|
INSTALL.md | doc | 1.9 KB |
README.md | doc | 4.6 KB |
SKILL.md | doc | 13 KB |
External hosts referenced
github.com raw.githubusercontent.com img.shields.io
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/openclaw-checkpoint
- Raw scan result: openclaw-checkpoint-personal-ai-assistant-backup-&-recovery-scan.json
- Badge for your README:
- Request a re-scan