Secure sync for OpenClaw memory and workspace. Use /sync to push, /restore to pull, /sync-status to check. Supports versioned backups and disaster recovery.

What to consider before installing: - Required secrets are not declared in the registry metadata: this skill needs BACKUP_REPO and BACKUP_TOKEN (stored in ~/.openclaw/.backup.env). The omission is a packaging/information risk — double-check you supply only the credentials you intend. - Use a minimal, revocable token in a private, dedicated repository: create a new private repo for backups and generate a fine-grained (or repo-scoped) token limited to that repository and to the minimum permissions required. Prefer revocable tokens so you can delete them quickly if needed. - Review what will be pushed: the tool copies workspace files and entire skills/* directories. Run a dry-run first (/sync --dry-run or node scripts/push.js --dry-run) to see exactly which files would be uploaded. Make sure no other skill stored secrets in file form under skills/ or workspace/ that you don't want off-machine. - Token handling risks: the scripts embed the token into git HTTPS URLs for exec'd commands. That is convenient but can leak tokens into process listings, temporary git configs, or logs if runs fail. To mitigate: run initial tests in a sandbox account or VM, monitor temporary folders (~/.openclaw/.sync-staging, .sync-restore, .local-backup) and delete them manually after successful runs, and prefer a short-lived token. - Check duplicates and packaging oddities: the package contains duplicated copies of the code (top-level and claw-sync/). That may be benign (packaging artifact) but is unusual — inspect which path your environment will execute (the SKILL.md points to node skills/claw-sync/index.js). - Cron/autosync: setup-cron only writes a config file and suggests activation; it does not enable system crontab by itself. Don't enable automatic scheduled backups until you've validated dry-run behavior and are confident about token scoping and which files are being uploaded. - If you proceed: run a dry-run, use a dedicated repo and token, review the code (push/pull scripts) yourself, test in an isolated environment, and rotate/delete the token after verifying functionality.

Type: OpenClaw Skill Name: claw-sync Version: 2.0.2 The OpenClaw AgentSkills skill bundle 'claw-sync' is designed for secure, versioned synchronization of OpenClaw memory and workspace to a Git repository. It includes several security features such as explicit exclusion of sensitive files (`openclaw.json`, `.env`) from synchronization, validation of repository URLs to restrict to allowed hosts (GitHub, GitLab, Bitbucket), sanitization of tokens from error messages, and robust path/version validation to prevent command injection and path traversal during restore operations. While it uses `child_process.execSync` for Git operations and sets up a cron job for auto-sync, these actions are transparent, necessary for its stated purpose, and include mitigations against misuse. No evidence of intentional harmful behavior, data exfiltration beyond the configured repository, or malicious prompt injection was found.