每日 Git 备份。提交工作区所有变更，记录变更摘要。触发时机：cron 定时任务或手动调用。

Do not install or enable this skill until the missing pieces are clarified and reviewed. Specifically: - Ask the author to provide scripts/auto-backup.sh and any other referenced scripts; review their contents line-by-line before execution. The script could run arbitrary shell commands. - Require the skill manifest to declare required binaries (e.g., git) and any environment variables it needs (Feishu webhook or token, git remote credentials). Do not supply high-privilege or broadly-scoped credentials without justification. - Confirm whether the backup will push to a remote repository and, if so, where (remote URL) and how authentication is handled. Avoid giving long-lived credentials; prefer a dedicated deploy key or webhook with least privilege. - Because the instructions commit 'all workspace changes', audit the repository for secrets and consider running in an isolated environment or CI runner with limited access. - Prefer Feishu webhooks (read-only inbound) over embedding tokens; insist the skill declare exactly how it will authenticate and which Feishu endpoint it will use. - If you must test, do so in a throwaway repository/VM with no sensitive data and with network access restricted. If the author cannot provide the missing script or clear credential requirements, treat the skill as unsafe.

Type: OpenClaw Skill Name: daily-backup Version: 1.0.1 The skill bundle is classified as suspicious because it requires high-risk capabilities, specifically shell script execution (scripts/auto-backup.sh) and network communication to an external Feishu endpoint. While the instructions in SKILL.md and references/spec.md describe a legitimate backup workflow, the actual shell script content is missing from the bundle, and the automated reporting mechanism could be leveraged for data exfiltration if the underlying script is designed to collect sensitive information.