OpenClaw State Backup

Create, inspect, and restore versioned OpenClaw state backups with rollback safety. Use when backing up or migrating OpenClaw memory, workspace state, gatewa...

This skill appears to implement the stated backup/restore functionality, but take care before using it on important data: - The included scripts will read and write files under your home (~/.openclaw) and the provided workspace path; backups can contain sensitive data (including local skills). Treat output .tar.gz files as sensitive and store/encrypt them appropriately. - The restore script distributed here appears truncated/buggy: the shipped file ends mid-function and the final_report construction refers to an undefined variable (likely a bug: 'warning' vs 'warnings'). Expect runtime failures on a real restore. Do NOT rely on this restore script for production restores until the code is fixed and fully tested. - There are logic bugs (e.g., comparisons of paths when computing 'missingFromArchive' may not match due to differing string forms). Review and test both backup and restore with --verify-only and --dry-run on non-production data first. - Prefer encrypting archives at creation or storing them in a secure location, since archives are unencrypted by default. - If you want to proceed, ask the author for a corrected restore_state.py (complete file), or locally fix the undefined variable and test full/dry-run flows. Also audit any archived workspace/skills content for secrets before shipping archives off-host. If the author supplies a complete, corrected restore script and tests showing successful dry-run and real restores, that would increase confidence and could move the classification to 'benign'.

Type: OpenClaw Skill Name: openclaw-state-backup Version: 1.0.2 The skill provides comprehensive backup and restore functionality for OpenClaw state but contains a significant security vulnerability. Specifically, `scripts/restore_state.py` utilizes `tar.extractall()` without path validation or security filters, making the system vulnerable to directory traversal (ZipSlip) attacks if a malicious archive is processed. Additionally, `scripts/backup_state.py` collects and stores system metadata, including the host's hostname and platform details, within the backup manifest.