Scan Report
45 /100
clawclone
Backup, clone, and migrate OpenClaw data across instances with cloud upload/download
ClawClone skill documents backup of API keys and tokens with cloud upload capability, but the implementation file (clawclone.mjs) is missing, making it impossible to verify actual behavior.
Use with caution
Do not use until implementation files are provided and reviewed. The documented ability to backup credentials to an external cloud service raises significant data exfiltration concerns.
Findings 4 items
| Severity | Finding | Location |
|---|---|---|
| High | Missing implementation file Doc Mismatch | SKILL.md:1 |
| High | Documented credential backup capability Credential Theft | SKILL.md:23 |
| Medium | Undeclared shell execution Doc Mismatch | SKILL.md:6 |
| Low | Hardcoded API key placeholder Sensitive Access | SKILL.md:209 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md:8 'write: ~/.openclaw/' |
| Network | READ | WRITE | ✗ Violation | SKILL.md:9 'network: https' but upload operations implied |
| Shell | NONE | WRITE | ✗ Violation | SKILL.md documents node clawclone.mjs execution |
1 High 3 findings
High API Key 疑似硬编码凭证
API_KEY="your_clawclone_api_key" SKILL.md:209 Medium External URL 外部 URL
https://clawclone.cc SKILL.md:3 Medium External URL 外部 URL
https://clawclone.cc/dashboard/settings SKILL.md:49 File Tree
2 files · 5.7 KB · 231 lines Markdown 1f · 220L
JSON 1f · 11L
├─
package.json
JSON
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
node | >=16.0.0 | system | No | System dependency, not a package manager dependency |
Security Positives
✓ SKILL.md is well-structured and documents functionality clearly
✓ Test mode (--test flag) available for safe preview before operations
✓ Local operations don't require API key - cloud features are optional
✓ Pre-restore backups created automatically at ~/.openclaw/backup