gitbackup

Create a local Git bundle backup of the OpenClaw workspace repository. Use when running /gitbackup in Telegram or when the user asks to back up Git history/refs to a local file.

Security Scan

The skill does what it says (creates a local git bundle of the workspace); the included script is short and aligned with the description — no network exfiltration or hidden behavior — but note minor metadata/permission details you should check before installing.

Purpose & Capability

The skill's name, description, SKILL.md, and provided script all consistently implement creating a local git bundle of the workspace. Minor mismatch: the skill metadata lists no required binaries, but the script requires git to be present (git is invoked via the git CLI).

Instruction Scope

SKILL.md simply instructs running the bundled script. The script only checks that the workspace is a Git repo, creates a backup directory, runs `git bundle create --all`, and prints path/size. It does not call external endpoints, read unrelated system config, or delete other data. Note: the bundle includes all refs/history and therefore may contain sensitive secrets present in the repo.

Install Mechanism

Instruction-only skill (no install spec). There is a small included script but no downloads or package installs, so nothing is fetched from external URLs and nothing is written to disk aside from the created backup bundle when run.

Credentials

The skill requests no environment variables or credentials (appropriate). It will read the entire workspace repository; that access is necessary for the stated purpose but could expose sensitive repo contents in the resulting bundle. Also the metadata omits declaring the dependency on the git binary.

Persistence & Privilege

The script writes persistent files to /root/.openclaw/backups. That is expected for a backup tool, but requires that the agent process has filesystem write access to that path (which often implies elevated or container root permissions). The skill does not modify other skills or system configs and is not set to always:true.

Assessment

What to check before installing/running: 1) Confirm the git CLI is available to the agent (metadata did not list it). 2) Inspect the script (it's short; it only runs git bundle create --all) and confirm you're comfortable letting the agent read the entire workspace repo — the bundle will include all history and refs and may contain secrets. 3) Ensure you want backups written to /root/.openclaw/backups and that there is sufficient disk space and secure storage for the bundles; consider changing the path if you don't want root storage. 4) The skill makes no network calls, so it won't exfiltrate data over the network by itself, but the generated bundle is local and must be protected. 5) If you want retention or offsite copies, implement additional tooling; the script explicitly says not to delete older bundles. 6) Run first in a safe environment (or inspect/modify the path) if you have any doubts.

Git Backup (local bundle)

Overview

Create a self-contained Git bundle of the workspace repo and store it in /root/.openclaw/backups.

Quick start

Run the bundled script:

bash /root/.openclaw/workspace/skills/gitbackup/scripts/git-backup.sh

Output

Print the bundle path and size. The bundle filename includes UTC timestamp.

Notes

• If the workspace is not a Git repo, exit with a clear error.
• Do not delete older bundles.