VPS Bootstrap

Bootstrap a fresh VPS from zero to a fully operational OpenClaw deployment, with backup/restore and post-recovery verification. Use when setting up OpenClaw...

This script bundle appears to do what it says (system installs, OpenClaw install, backup/restore), but it will modify system configs and manage sensitive secrets. Before running: (1) review the scripts line-by-line — especially the curl | bash NodeSource step and the npm install -g openclaw; (2) back up existing ~/.gnupg, ~/.password-store, ~/.config/rclone and any keyrings because restore.sh can overwrite them; (3) remove or change the %no-protection flag in the GPG key params if you want a passphrase‑protected key; (4) run the bootstrap on a disposable/test VM first; (5) consider manually running the networked install commands after inspecting them rather than via the automated script; and (6) confirm you trust the source before allowing these high‑privilege operations.

Type: OpenClaw Skill Name: vps-bootstrap Version: 1.0.0 The skill bundle is classified as suspicious due to several high-risk operations, despite their stated legitimate purpose. The `bootstrap.sh` script uses `curl -fsSL ... | sudo -E bash -` to install Node.js, which is a powerful pattern that executes arbitrary code with root privileges from a remote source, posing a supply chain risk if the source is compromised. Additionally, the `restore.sh` script performs extensive file system manipulation, copying potentially sensitive data (GPG keys, password store, `.env` files, OAuth credentials) from a user-provided backup to critical system locations. While intended for legitimate backup restoration, this capability could be abused if a malicious backup file is supplied, leading to potential system compromise or data corruption. No direct evidence of intentional malicious behavior (e.g., exfiltration to unauthorized endpoints, stealthy backdoors) was found, but these capabilities represent significant vulnerabilities.