openclaw-backup-guide

Automates hourly OpenClaw workspace backups with SQLite database export, optional NAS sync via rsync, and GitHub version control commits and pushes.

This bundle looks like a personal backup snapshot repackaged as a skill. Before installing or running anything: - Inspect and edit both scripts. Replace hard-coded paths (projectDir, SRC) and the hard-coded NAS host/user with variables you control. Do not run the scripts until those are set to your intended locations/hosts. - Note the documentation mismatch: SKILL.md/README mention rsync, but backup-nas.sh uses tar+scp. Decide which method you actually want (rsync generally preserves deltas and is safer for large repos). - Remove or avoid scp to unknown hosts. The script will send a full workspace tarball and a DB file to 192.168.4.95:lstone by default — that could exfiltrate sensitive data if left unchanged. If you do need remote backups, point to your own trusted target or use encrypted transfer/at-rest encryption. - The scripts suppress stderr (2>/dev/null), which hides failures and could mask problems or abuse; remove that redirection while testing so you can see errors. - Avoid committing sensitive databases to a Git repo unless the repo is private and you have encryption or other access controls. Prefer storing backups outside VCS or encrypting the backup artifacts before committing. - backup-db.js expects better-sqlite3 in the target project's node_modules and a very specific folder layout; adjust the script to take configurable paths or to use a bundled dependency to be more robust. - Run the scripts in a safe test environment first (not on your production workspace). Consider doing a dry-run (no scp/git push) to validate behavior. Given the hard-coded personal values and doc/code mismatches, treat this as a potentially sloppy or repurposed personal utility rather than a vetted, generic backup skill. If you want to use it, sanitize and parameterize the scripts and verify endpoints/permissions first.

Type: OpenClaw Skill Name: openclaw-backup-guide Version: 1.0.0 The skill is classified as suspicious due to the `backup-nas.sh` script containing hardcoded paths and a specific private IP address (`[email protected]`) as the `scp` target. While the stated purpose is backup, this hardcoding means that any user installing this skill without modifying the script would attempt to send their workspace data to the author's specific local network NAS, rather than a configurable target. This represents a significant data leakage risk and a severe design flaw for a public skill, even if the target is a private IP and likely an oversight rather than intentional malice.