System Integrity And Backup

Encrypted backups, integrity verification, and data retention enforcement for Greek legal requirements (5-20 year retention). AES-256.

This skill appears to do what it claims (local AES-256 encryption, hashing, retention rules). Before installing, confirm these operational points: 1) Ensure the openclaw CLI referenced in the docs actually exists in your environment and you trust it. 2) Decide how scheduled jobs will get OPENCLAW_ENCRYPTION_KEY securely (use a secrets manager or orchestrator injection rather than leaving a long-lived plaintext export in shell startup files). 3) Change verification restore targets to a secure, access-controlled location inside your data directory (or ensure /tmp is encrypted and access-limited) to avoid writing plaintext backups to an insecure temp path. 4) Verify scheduling behavior (how/where background jobs run) because the SKILL.md describes background operation but provides no service/daemon install steps. 5) Confirm that human-approval hooks for deletions and migration rollbacks are implemented and tested. If these points are clarified and implemented, the skill is coherent with its stated purpose.

Type: OpenClaw Skill Name: system-integrity-and-backup Version: 0.1.0 The skill is classified as suspicious primarily due to a critical security vulnerability regarding the handling of the encryption key, as documented in `SKILL.md`. The skill's header metadata explicitly states that the `OPENCLAW_ENCRYPTION_KEY` is 'never stored on disk,' but a later section under 'Backup Architecture' contradicts this by indicating the key is 'stored in /data/auth/backup-key.enc.' This design flaw significantly increases the risk of compromise for encrypted backups. While the skill's overall purpose (system integrity, backup, and retention) is legitimate, this key management inconsistency represents a severe vulnerability that could be exploited.