Restic Home Backup

Design, implement, and operate encrypted restic backups for Linux home directories with systemd automation, retention policies, and restore validation. Use w...

This skill appears to do what it says, but review and run it safely: 1) Read scripts/bootstrap_restic_home.sh yourself before running. 2) Run it in PLAN-ONLY mode first (no --apply) to inspect the proposed changes. 3) Ensure restic is installed and reachable at /usr/bin/restic (adjust script if restic is elsewhere). 4) Be prepared that the script will create /etc/restic-home.env and a password file at /etc/restic-home/password (chmod 600) — if you prefer an existing password file or secret manager, supply that path via --password-file. 5) Only run with --apply and enable timers when you accept the systemd/unit changes and understand where your repository (S3/SFTP/local) stores data and credentials. 6) If you need this on non-standard home paths (e.g., root), verify the script handles that or modify accordingly.

Type: OpenClaw Skill Name: restic-home-backup Version: 1.0.2 The skill bundle is classified as suspicious due to several critical shell injection and path traversal vulnerabilities in `scripts/bootstrap_restic_home.sh`. User-provided inputs for `--repo`, `--password-file`, `--user`, and `--timezone` are not adequately sanitized before being written into configuration files or used in commands. This could allow a malicious actor to achieve arbitrary command execution (e.g., via crafted `--repo` value), manipulate arbitrary files (via `--password-file`), or alter the backup scope (via `--user`). While the `SKILL.md` defines good safety boundaries and the script implements an `--apply` mechanism, these vulnerabilities represent significant risks without clear evidence of intentional malicious design.