safe-backup

Backup OpenClaw state directory and workspace. Includes excluding sensitive files, packaging for backup. Triggered when user asks to backup, export, or save...

This skill appears to do what it says, but before installing or running: 1) verify rsync and tar are available on your environment (Windows may need Git Bash/MSYS/WSL); 2) review the generated tarball contents before uploading anywhere — the script excludes many sensitive patterns but you should still inspect the archive; 3) encrypt backups before storing in the cloud or a repo; 4) be aware auth-profiles.json and other credential files are intentionally excluded and you will need to re-authenticate services after restore; and 5) if you want automated remote upload, implement it separately and review its access requirements (this script does not perform remote uploads itself).

Type: OpenClaw Skill Name: safe-backup Version: 1.0.5 The 'safe-backup' skill is designed to securely back up OpenClaw state and workspace directories. Both the `SKILL.md` documentation and the `scripts/backup.sh` script explicitly define and implement extensive exclusion patterns for sensitive files such as API keys, credentials, environment variables, and SSH keys. The `backup.sh` script performs only local file system operations (copying with `rsync`, archiving with `tar`, and cleaning up temporary files) and does not initiate any network connections or data exfiltration. While `SKILL.md` suggests optional manual steps for storing backups to remote locations (e.g., private GitHub repositories or remote rsync servers), these are presented as post-backup user actions with security best practices (encryption, private repos) and are not part of the automated script's execution. There is no evidence of malicious intent, obfuscation, or prompt injection designed to compromise the agent or exfiltrate data.