Openclaw Complete Backup Delete Fresh Install Restore Cycle

The definitive, self-improving, community-wisdom-infused backup/restore skill. British dry humour + canine wisdom. Tested in production. Evolving with every...

This skill is coherent for a full destructive backup-and-restore workflow, but it handles secrets and requires root — treat it as high-risk until you review and harden it. Before using: (1) Read the entire SKILL.md and any helper scripts (openclaw-backup / openclaw-restore) to ensure there is no network exfiltration or unexpected commands. (2) Do not run blindly as root; test in an isolated sandbox or VM first. (3) Do not store raw backups containing credentials in plain /root/BACKUPS — encrypt backups (gpg or similar), set strict file permissions, and consider off-host secure storage. (4) Verify backup integrity before any delete step. (5) If you plan to allow automated or unattended runs, implement explicit safeguards (confirmation prompts, dry-run mode, and logs). If you want higher assurance, ask the author for an explicit threat model and a version of the workflow that encrypts and verifies sensitive data before and after movement.

Type: OpenClaw Skill Name: openclaw-complete-backup-delete-fresh-install-restore-cycle Version: 2.2.1 The SKILL.md file outlines a comprehensive system restoration workflow that involves high-risk operations, including executing remote scripts via 'curl | sh' (IOC: https://cli.openclaw.ai/install.sh), performing global 'npm' uninstalls, and using destructive commands like 'rm -rf' and 'pkill' with root/sudo privileges. While these actions are aligned with the stated purpose of a 'backup-delete-fresh-install' cycle, the automated handling of sensitive API keys and credentials, combined with the potential for significant system-wide impact, presents a substantial risk profile. The bundle is classified as suspicious due to these high-privilege execution patterns and the lack of explicit safeguards for the destructive operations it performs.