Security audit
Security checks for vulnerabilities and agentic risk
This backup skill appears to do its stated job, but it needs Review because it copies highly sensitive OpenClaw data to Git and has unsafe command and credential-handling choices.
Install only if you deliberately want nearly all OpenClaw state, including secrets and agent memory, committed to a trusted private Git repository. Use a minimally scoped revocable Git token, review the generated .gitignore and repository contents before pushing, avoid untrusted repo URLs or cron expressions, inspect crontab after enabling scheduling, and treat any existing backup repository as sensitive secret-bearing data.
// Add cron job
const cronLine = `${cronExpr} ${script}`;
execSync(`(crontab -l 2>/dev/null; echo "${cronLine}") | crontab -`, { shell: '/bin/bash' });
console.log(`Cron enabled: ${cronExpr}`);
}}
// Remove old and add new
execSync(`(crontab -l 2>/dev/null | grep -v "backup.*cli.js"; echo "${expr} ${cronScript(expr)}") | crontab -`, { shell: '/bin/bash' });
console.log(`Cron schedule updated: ${expr}`);
}Detected: suspicious.dangerous_exec