VPS Backup

Automated daily VPS backup using restic — backs up OpenClaw workspace, SSH keys, project code, and session transcripts. Configures encrypted incremental snap...

Before installing or running this skill: (1) Understand sensitivity — it will back up ~/.ssh and exported session transcripts; decide whether you want those included or excluded. (2) Verify and audit export_sessions.py before using it (the docs point to a raw GitHub URL) — don't run an unreviewed downloader that could exfiltrate or modify data. (3) If using offsite push, ensure RCLONE_DEST points to a trusted destination and that access credentials for that remote are handled securely; avoid sending private keys/chat logs to third-party storage. (4) The skill uses BACKUP_PASSWORD/RESTIC_PASSWORD but the registry metadata does not declare these env vars — make sure you securely generate and store the password (as recommended) and confirm where RESTIC_PASSWORD is set. (5) Consider removing ~/.ssh from BACKUP_PATHS or encrypting the repo and limiting remote retention if you don't want private keys backed up. (6) Prefer inspecting the script locally and testing on a non-production VM first. If you want, I can: (a) list exact lines in scripts that touch sensitive files, (b) show what export_sessions.py would be expected to do given its repo, or (c) suggest a safer backup config that excludes secrets.

Type: OpenClaw Skill Name: vps-backup Version: 1.0.0 The skill is designed to back up highly sensitive data, explicitly including the `~/.ssh` directory, which contains private access keys. While this aligns with the stated purpose of a VPS backup tool, the default inclusion of SSH keys and the use of `curl` to download and install binaries (`restic` and `rclone`) from external URLs in `SKILL.md` present significant security and supply chain risks. There is no evidence of intentional malice or hardcoded exfiltration, but the broad data access and installation methods are high-risk.