OpenClaw Sacred Rules

Provides essential safety rules and tools for managing OpenClaw configs, backups, auth troubleshooting, and recovery to prevent system failures.

Before installing or running this skill: (1) Review and fix the reset_cooldowns.sh embedded Python: it hardcodes '/Users/admin/...' which is inconsistent with the shell AUTH_FILE ($HOME) and can cause modifying the wrong file — correct it to use the same $AUTH_FILE path. (2) Recognize these scripts will read/copy/modify sensitive files (~/.openclaw/.env and auth-profiles.json). Only run them on a trusted machine, never as root, and ensure backup directories are private and/or encrypted. (3) Confirm the backup flow: safe_backup.sh copies .env and auth-profiles.json into $HOME/openclaw-backups — ensure that directory has restrictive permissions (700) to avoid leaking secrets. (4) If you do not trust the source, don't run the scripts; instead manually inspect and adapt them (especially remove or correct the hardcoded path and add explicit permission/ownership checks). (5) Ask the publisher or maintainer for clarification of required file/permission access and for a signed canonical source; prefer a skill that declares the exact sensitive files it touches and documents backup storage protections. If you want, I can produce a corrected version of reset_cooldowns.sh (and its Python block) that consistently uses $HOME and adds safety checks and permission-locking for the backup directory.

Type: OpenClaw Skill Name: openclaw-sacred-rules Version: 1.0.0 The skill bundle aims to provide safety rules and recovery procedures for OpenClaw configuration, which is a benign purpose. However, the `scripts/reset_cooldowns.sh` script contains a hardcoded absolute path (`/Users/admin/.openclaw/...`) for a critical configuration file, making it non-portable and prone to failure on systems where the user's home directory is different. Similarly, a Python snippet in `references/recovery.md` uses an unexpanded `$HOME` variable within a string, which would also lead to execution failure. These are significant functional vulnerabilities in critical recovery scripts, classifying the bundle as suspicious due to potential operational failures rather than malicious intent.