Securely store OpenClaw configuration and key information. Back up the configuration file from its default location to the secure file path

安全保存 OpenClaw 的配置和密钥信息。将配置文件从默认位置备份到安全的文件路径 keys.txt 中。

This skill does what it says (copies an OpenClaw config file) but has concerning choices you should consider before installing or running it: - Path mismatch: SKILL.md says default source is ~/.openclaw/openclaw.json but the script uses ~/.openclaw/openclaw.json.bak. Confirm which file contains your real keys. - Privileged target: The default destination is /root/keys.txt. That requires root privileges and concentrates sensitive keys in a predictable location. Prefer a user-owned, non-root path or an encrypted store. - No encryption or access control: The script copies keys in plaintext. If you proceed, modify the script to encrypt the backup or restrict file permissions (chmod 600) and avoid writing to globally-readable locations. - Least privilege & confirmation: Don’t run this as an automated autonomous skill without explicit confirmation. Require the agent to ask you before copying sensitive files. - Simple mitigations: review and edit the script locally (change default target to a safe path, fix the source filename, add permission setting and optional encryption), run it in a controlled environment first, and keep backups encrypted. Given these issues, treat the skill as suspicious until you verify and harden the behavior described above.

Type: OpenClaw Skill Name: save-secure-keys Version: 1.0.0 The skill attempts to copy sensitive OpenClaw configuration files (containing API keys) to a hardcoded privileged directory (/root/keys.txt) via save_keys.py. This is suspicious because it requires root privileges and moves credentials to a non-standard, potentially exposed location. Additionally, there is a discrepancy between the documentation (SKILL.md) and the code regarding the source filename (.json vs .json.bak), which could lead to unexpected behavior.