Caveat verdict
openclaw-daily-backup
Backup and restore skill for local OpenClaw workspace files with versioning and SHA-256 validation; operates entirely within local directories with no network access.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (7)
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
FINAL-DELIVERY-REPORT.md · prose · downgraded · curl | bash
Pipe to bash — executes piped content as shell commands
FINAL-DELIVERY-REPORT.md · prose · downgraded · | bash
Instructs covert action — may act without user awareness
backups/2026-03-14T05-39-50/IDENTITY.md · prose · downgraded · quietly
Accesses OpenClaw config/secrets directly
backups/2026-03-14T05-39-50/manifest.json · prose · downgraded · ~/.openclaw/openclaw.json
HTTP request to bare IP address — common in malicious payloads
backups/2026-03-14T05-39-50/openclaw.sanitized.json · prose · downgraded · http://127.0.0.1
Accesses system credential store
backups/2026-03-14T05-39-50/TOOLS.md · prose · downgraded · Keychain
References agent memory files
backups/2026-03-14T05-39-50/AGENTS.md · prose · downgraded · MEMORY.md
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.