OCTOOL for backup

Openclaw Visual Configuration Assistant. Provides secure wizard for local/Git backup and workspace migration.

This skill appears coherent for a browser-based backup wizard, but take these precautions before installing or using it: 1) Manually review the full oc-tool.html (search for fetch/XHR/WebSocket, eval, atob/decoded strings, or hidden endpoints) to confirm there are no hidden network calls or obfuscated code. 2) Test the page offline (disconnect network) and confirm DevTools → Network shows zero requests before entering any token. 3) If you use Git mode, create a fine-grained GitHub PAT limited to the specific repo and only 'contents: read & write' as recommended. 4) Always inspect generated shell commands before pasting them into your terminal; even well-intentioned scripts can be harmful if executed incorrectly. 5) Prefer running the tool in a disposable or isolated browser profile/tab and close the tab to ensure sessionStorage is cleared. If you want higher assurance, provide the full oc-tool.html for a complete code audit (I only saw a truncated excerpt here).

Type: OpenClaw Skill Name: octool Version: 1.0.17 The 'octool' skill bundle is a visual configuration and backup assistant for OpenClaw. Analysis of 'oc-tool.html' reveals a well-documented, frontend-only utility that generates shell commands for the user to manually execute in their terminal. The developer has implemented several security best practices, including regex-based input sanitization (e.g., 'sanitizePath', 'sanitizeTag') to prevent shell injection and the use of 'sessionStorage' to ensure GitHub tokens are cleared when the browser tab is closed. The tool's behavior is strictly aligned with its stated purpose of managing backups and environment migrations, with no evidence of data exfiltration, hidden backdoors, or malicious prompt injection.