GitHub 仓库备份技能 - 将 OpenClaw 工作空间备份到 GitHub 私有仓库。 支持两种模式：(1) 自动模式 - 定时自动备份 (2) 手动模式 - 交互式配置向导。 自动引导用户完成：GitHub Token 配置 → 仓库创建 → 初始化备份 → 设置定时任务。 用途：(1) 首次设置 (2...

Before installing or running this skill, consider the following: - Token handling: the workflow requires a personal access token (repo scope). Do not paste long-lived tokens into UI/chat unless you trust the agent. The provided script embeds the token in the Git remote URL, which will store it in .git/config in plaintext. Prefer alternatives: use a short-lived token, a deployment key, GitHub Actions with secrets, or a credential helper rather than embedding the token in the remote URL. - Repository creation mismatch: the skill description says it will create the repository but the script does not. Either manually create the private repo first, or inspect/extend the skill to use the GitHub API or gh CLI to create repos safely. - Sensitive data in backups: the script includes skills/ and memory/ in backups. Inspect the memory/ and skills/ contents for secrets, API keys, or credentials before backing them up. The SKILL.md claims 'API Keys not backed up', but that depends entirely on what files actually contain; do not assume secrets are excluded automatically. - Storage location and permissions: the script expects /root/.openclaw/workspace (and SKILL.md sometimes uses ~/.openclaw). Run the script as a non-root user where possible, confirm paths, and check file ownership and permissions so backups are not readable by unintended users. - Cron scheduling: the skill uses openclaw cron. Verify that 'openclaw cron add' behaves as expected in your environment and that scheduled jobs do not leak tokens (e.g., via command-line arguments visible in process lists or logs). - Safer alternatives: consider using a deploy key or repository-specific token with minimal permissions, using a Git credential helper or GPG-encrypted secrets in the repo, or using a hosted backup solution. If you proceed, rotate the token after initial testing and limit its scope and lifetime. If you want, I can: (1) produce a safer version of the backup script that avoids writing the token into .git/config (for example, using a temporary credential helper or GIT_ASKPASS wrapper), (2) add a repository-creation step using the GitHub API/gh with explicit permission guidance, or (3) produce a checklist of files to exclude from backups.

Type: OpenClaw Skill Name: alfred-github-backup Version: 1.0.0 The skill is a legitimate utility designed to back up the OpenClaw workspace to a user-defined private GitHub repository. It uses a shell script (scripts/backup.sh) to automate Git operations and correctly prompts the user for credentials (GitHub Token) and configuration. While storing a token in a Git remote URL is a known security weakness (vulnerability), the behavior is transparently documented in SKILL.md, aligns with the stated purpose, and contains no evidence of unauthorized data exfiltration or malicious intent.