企业级备份恢复工具包，支持文件备份、数据库备份、增量备份、定时任务和灾难恢复。 Enterprise-grade backup and recovery toolkit supporting file backup, database backup, incremental backup, scheduled t...

This package largely behaves like a normal backup toolkit, but review and precautions are recommended before installing or running it: - Verify presence of system binaries: the code calls mysqldump, pg_dump and mongodump via subprocess but the skill metadata does not declare these required binaries. Ensure these tools exist on any host where you run this. - Inspect the full scripts/backup_toolkit.py (the provided listing was truncated) to confirm there are no hidden network endpoints or unexpected data exfiltration paths (especially code that would use paramiko/cryptography to send backups remotely). - Avoid passing DB passwords on the command line or hard-coding them. The current examples & implementation may expose credentials via process lists; prefer using secured credential stores or connection files. - Run the code first in a disposable, limited-permission environment (container or VM) with test data to confirm behavior and that only intended files are read and written. - If you need remote backup features, confirm how SSH keys/credentials are handled; do not supply high-privilege keys without auditing the remote-transfer implementation. Because the repository lacks an install spec and does not declare required system binaries, treat the package as potentially incomplete and verify these gaps before trusting it with production data.

Type: OpenClaw Skill Name: backup-recovery-toolkit Version: 1.0.0 The toolkit contains a potential path traversal vulnerability (TarSlip) in scripts/backup_toolkit.py within the RestoreManager.restore_file_backup method, which uses tarfile.extractall() without validating member paths. Additionally, the DatabaseBackup class handles sensitive credentials insecurely by passing them as command-line arguments (MySQL/MongoDB) or environment variables (PostgreSQL), exposing them to process monitoring. While these are significant security flaws, they appear to be unintentional vulnerabilities rather than intentional malicious behavior.