Session Sync Cloud

Automatic cloud backup and sync for OpenClaw memory files. Encrypted upload to S3/Backblaze, versioned retention (30 days), cross-device restore. Includes we...

Do not assume your backups will be end-to-end encrypted — the documentation promises AES-256 client-side encryption but the included Python script does not implement any encryption or use an encryption key. Before installing or pointing this skill at real data: - Ask the author to provide the complete, untruncated source and an explicit implementation of client-side encryption (or remove the encryption claims). Verify the code actually encrypts data before any network call. - Avoid putting real credentials or sensitive data in session-sync-config.json in plaintext until you trust the implementation. Use a bucket and access key with minimal permissions (e.g., a dedicated key limited to PutObject/DeleteObject/ListObjects on a single bucket/prefix). - Test with non-sensitive dummy data first to confirm behavior (uploads, pruning, restore). - Confirm how dashboard restore is intended to work (the HTML references an HTTP endpoint that the script does not provide). - If you need true E2E encryption, insist on peer-reviewed crypto code or use a vetted client-side encryption library (e.g., AWS S3 client-side encryption SDKs) and do not rely on deriving keys from credentials. Given the mismatch between claims and code, treat this skill as suspicious and avoid pointing it at any sensitive workspace until the author fixes and documents the missing encryption and provides the complete working code.

Type: OpenClaw Skill Name: session-sync-cloud Version: 1.0.0 The skill documentation (SKILL.md) explicitly claims to provide AES-256 encryption for cloud backups so that the 'server never sees plaintext,' but the implementation in scripts/run.py lacks any encryption logic, uploading memory files in plaintext. This critical discrepancy between the security claims and the actual code behavior creates a false sense of security. Additionally, the generated memory/sync-dashboard.html includes a script that attempts to trigger restores via a local web endpoint (/restore) not implemented in the provided code, which is unusual for a standalone skill.