self-backup-to-feishu
WarnAudited by ClawScan on May 18, 2026.
Overview
This skill has a coherent backup purpose, but it backs up and restores sensitive assistant memory, email configuration, and cron jobs through a Feishu document with insufficient scoping and review controls.
Only use this skill if you intentionally want Feishu to store your assistant memory and configuration. Before installing, remove or encrypt secrets such as .msmtprc, restrict Feishu document permissions, review every restored file and cron job, and make sure you know how to disable the scheduled backup.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your email sending configuration, potentially including secrets, could be copied into a Feishu document or local backup file.
The script reads the local .msmtprc email configuration and embeds it directly into the generated backup content, which may include SMTP credentials or authorization details.
"msmtprc": ".msmtprc" ... "## 六、邮箱配置" ... {msmtprc if msmtprc else "# 未找到配置"}Exclude .msmtprc by default, redact secrets, or require explicit user confirmation and encryption before backing it up to Feishu.
If the Feishu document is stale, shared too broadly, or edited by someone else, it could change the assistant's long-term memory or behavior after recovery.
The recovery guide tells the agent to trust a Feishu document and use it to recreate persistent identity, user, behavior, and memory files.
使用 `feishu_doc` 工具读取状态备份文档 ... 写入对应文件 ... IDENTITY.md ... USER.md ... SOUL.md ... MEMORY.md
Require a visible diff, document-permission check, and explicit user approval before restoring persistent memory or behavior files.
A restored cron entry could run commands repeatedly in the background, including outdated or unsafe automation.
The restore process includes adding cron tasks from the backup document, which can create or re-enable persistent command execution.
从「六、自动化任务」章节提取 cron 任务，逐行添加 ... (crontab -l 2>/dev/null; echo "0 3 * * * /usr/bin/python3 /path/to/script.py") | crontab -
Do not restore cron jobs automatically; show each task to the user, restore only whitelisted entries, and provide an easy rollback command.
The assistant may maintain recurring backup behavior after setup, rather than only acting when manually invoked.
The skill openly describes scheduled and event-triggered backup behavior, which is purpose-aligned but still creates autonomous background activity.
自动备份：每日定时、事件触发 ... 每日定时备份（建议凌晨3点） ... 掌握新技能时 ... 完成自动化任务时
Install scheduled backups only after explicit approval, document how to disable them, and keep the schedule limited to this skill's backup job.