Elegant Sync

This skill appears to implement backup-to-git as advertised, but there are several practical risks you should consider before installing: 1) It expects a BACKUP_REPO and BACKUP_TOKEN saved in ~/.openclaw/.backup.env, but the registry metadata does not declare these — verify you are comfortable providing a git token. 2) The code embeds the token into the HTTPS push URL (https://TOKEN@...), which can leak via process lists, git remotes, or logs; prefer using a git credential helper or a deploy token with minimal scopes. 3) The README and SKILL.md claim sensitive files (.env, openclaw.json, credentials/) won't be uploaded, but the code's default ignore list does not include .env, openclaw.json, or credentials/ — unless your workspace .gitignore lists them they may be backed up. Inspect and/or add robust ignore rules before running. 4) The tool does a forced push (--force) to instance branches which can overwrite remote branches; ensure you push to a private backup repo and understand the effects. 5) If you proceed, create a dedicated private repo and a narrowly scoped token (remove repo access after testing), review the index.js source, add explicit ignore entries for all secrets, and run sync with --dry-run first. If you want, I can suggest exact code fixes (add .env/openclaw.json/credentials to ignorePatterns, avoid embedding token in URL, use git credential helper, remove --force) or generate a safer wrapper that uses a credential helper and stricter excludes.