The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/config.sh script does not properly sanitize the user-provided bucket name before writing it to a configuration file. Since this configuration file is subsequently executed via the source command in backup.sh, restore.sh, and list_backups.sh, it allows for arbitrary shell command execution through command substitution (e.g., using $(command) as a bucket name) when these scripts are later run.
[CREDENTIALS_UNSAFE]: The backup logic in scripts/backup.sh explicitly includes .env files in its collection scope within the /root/.openclaw/ directory. These files often contain sensitive secrets, API keys, and credentials, which are then copied to external storage (TOS drive), potentially leading to unauthorized data exposure if the storage is not properly secured.
[INDIRECT_PROMPT_INJECTION]: The restoration functionality (scripts/restore.sh) allows the agent to ingest and apply system configurations, memory data, and skill scripts from an external source. This creates a vulnerability surface where a compromised or malicious backup could influence the agent's future behavior or compromise the integrity of the environment.
Ingestion points: scripts/restore.sh reads and copies files from the external TOS mount point into /root/.openclaw/ and the workspace.
Boundary markers: None identified; the restoration process involves direct recursive copying (cp -r) of files to system configuration paths without delimiters or validation.
Capability inventory: The skill has the capability to write to the file system, execute shell scripts, and modify system-wide agent configurations.
Sanitization: No validation, integrity checks, or sanitization are performed on the backup data before it is restored to the system.

byted-tos-openclaw-backup