TimeMachine

Create, list, and rollback incremental snapshots of OpenClaw configs and memory with optional auto-backups and retention policies.

This package is a local backup/restore tool for OpenClaw and mostly does what it claims, but take care before installing: - It copies secrets: snapshots include credentials/* and .env (unencrypted) — ensure ~/.openclaw/snapshots is protected (file permissions, disk encryption) and consider encrypting snapshots before storing them. - The README promises auto-snapshot and prompting behavior configurable via openclaw.json, but the provided scripts do not parse openclaw.json or hook into edit events — automatic behavior requires extra integration (cron, file-watchers, or modifying the code). Treat autosnapshot settings in the docs as informational rather than implemented. - Default cleanup/retention values are hard-coded in cleanup.py (RETENTION_DAYS=7, MAX_COUNT=50); if you rely on openclaw.json for retention you should modify the scripts to read that config. - The code runs only locally and performs file copy operations; inspect the scripts yourself and test in a safe environment. If you need remote backups, add explicit, secure upload code (with encryption) — avoid sending snapshots (which include secrets) to untrusted endpoints. If you decide to use it: run it in a controlled environment, verify permissions on the snapshots directory, consider adding encryption for stored snapshots, and update the code if you need the advertised automatic/integration behaviors.

Type: OpenClaw Skill Name: time-machine Version: 1.0.0 The 'time-machine' skill bundle is a legitimate utility for creating and restoring local backups of OpenClaw configurations and workspace data. It handles sensitive files such as credentials and environment variables in 'snapshot.py' and 'restore.py' as part of its core functionality, but it performs all operations locally within the user's home directory (~/.openclaw/snapshots) and shows no evidence of data exfiltration or malicious intent. While the code contains minor bugs, such as an undefined variable in 'snapshot.py' and misleading documentation in 'SKILL.md' regarding secret encryption, these are non-malicious implementation flaws rather than intentional vulnerabilities.