OpenClaw Backup & Restore

This skill should be used when the user asks for OpenClaw backup, restore, rollback, validation, GitHub backup, off-machine backup, workspace recovery, or pr...

This skill appears to do what it claims, but take these precautions before installing or enabling automation: 1) Inspect scripts/backup-and-push.mjs and scripts/backup.mjs yourself — search for any network endpoints, unexpected HTTP/HTTPS requests, or obfuscated code. 2) Verify the openclaw.json sanitization logic (patterns listed in CHANGELOG) and test backups to ensure secrets are redacted; avoid using --raw-openclaw-config unless you understand the consequences. 3) Do not push backups to a public GitHub repo; use a private repo or encrypted/off-machine storage. 4) Check package.json for added dependencies before running. 5) Run backups and validate in a safe environment (local VM or disposable workspace) and confirm validate.mjs detects corruption and redaction as promised. 6) Ensure backups/ directory permissions are restrictive (700) and consider encrypting backups at rest. 7) Note the minor documentation tension: .gitignore is said to exclude backups/ yet the skill documents scripts to add/push backups — decide whether you will track backups in git. If you want to proceed, test manual runs first and only enable cron/GitHub Actions after confirming sanitization and repository privacy.

Type: OpenClaw Skill Name: openclaw-workspace-backup-restore Version: 1.5.4 This skill bundle provides a comprehensive and professional-grade backup and restore utility for OpenClaw workspaces. It includes scripts for creating timestamped backups (scripts/backup.mjs), listing them (scripts/list.mjs), validating integrity via SHA-256 hashes (scripts/validate.mjs), and restoring files with automatic safety rollbacks (scripts/restore.mjs). It also features a remote synchronization script (scripts/backup-and-push.mjs) that pushes backups to a user-configured Git repository. While the tool handles sensitive configuration files like openclaw.json, it includes a robust sanitization mechanism to redact API keys and tokens by default. The high-risk capabilities (file system access and remote Git operations) are clearly aligned with the stated purpose and are accompanied by extensive documentation, safety warnings, and dry-run options.