OpenClaw Backup & Restore

Backup and restore OpenClaw configuration, agents, sessions, and workspace to/from a private Git repository. Use when the user wants to manually trigger a ba...

Before installing or running this skill, make sure you: 1) Verify OPENCLAW_BACKUP_REPO is set to a private, access-controlled repository (do not push secrets to a public repo). 2) Confirm you have git, rsync, npm, and the OpenClaw CLI available on the machine; the skill metadata currently does not declare these requirements. 3) Understand that restore runs 'npm install' in any folder with package.json — that can run arbitrary install scripts from code stored in the backup. Consider disabling automatic npm installs (or review package.json files) when restoring. 4) Ensure your SSH/git credentials used for push/pull have appropriate scope and rotate credentials if you suspect exposure. 5) Test the backup/restore flow on a non-production copy first to validate behavior and the rsync/git semantics (watch for nested directory issues). 6) If you plan to proceed, update the skill metadata or documentation to list required binaries and clearly warn about the sensitivity of files under ~/.openclaw. If you want, provide the agent with a read-only or restricted backup repo and review the contents before running npm install or pushing sensitive files.

Type: OpenClaw Skill Name: openclaw-backup-restore Version: 1.0.3 The skill automates the backup and restoration of the entire OpenClaw environment, including sensitive configuration files, identity keys, and session memory, to a user-defined Git repository. While the scripts (scripts/backup.sh and scripts/restore.sh) are aligned with the stated purpose, they perform high-risk actions such as exfiltrating sensitive data to a remote endpoint and executing 'npm install' on restored files. This poses a significant risk of data exposure or supply chain compromise if the backup repository is not properly secured by the user.