Claw Backup
v1.0.7Back up OpenClaw customizations (memory, config, skills, workspace) to cloud storage via rclone, with scheduling + retention. Works on macOS, Linux, and Windows (Git Bash/WSL).
⭐ 3· 2.7k·23 current·24 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (backup OpenClaw data to rclone/local with scheduling and retention) align with the included files and runtime behavior: setup.js generates a backup script and plist/cron entries, and install-launchagent.sh installs a user LaunchAgent. The files the scripts access (~/.openclaw, clawd, Dev/CursorApps/clawd, project markdown) are exactly the stated backup targets.
Instruction Scope
SKILL.md and README explicitly describe what will be read and written and warn users to inspect scripts before running. The setup and backup scripts only read local paths, produce archives, write a manifest (hostname/os), and call rclone for transfer when configured; they do not embed remote endpoints or unexpected network callbacks beyond rclone copy.
Install Mechanism
There is no external install spec in the registry entry; recommended install is via git clone + running the bundled setup.js. The package does include local scripts (setup.js and install-launchagent.sh) that are written to disk when run — no downloads from arbitrary URLs occur by default. SKILL.md does include a discouraged curl | node one-liner and explicitly warns against running it without inspection.
Credentials
The skill declares no required environment variables or credentials. Cloud uploads use the user's existing rclone config (no new API keys requested). The files and directories accessed are consistent with backing up OpenClaw data; no unrelated credential or system-wide secrets are requested in the code.
Persistence & Privilege
The skill installs scheduled jobs (LaunchAgent on macOS, cron on Linux, Task Scheduler on Windows) which is reasonable for a backup tool. The macOS installer will attempt to remove an old system LaunchDaemon using sudo if one exists — this requires user approval (password) and is documented in the script and SKILL.md. The skill does not set always:true and does not modify other skills' configs.
Assessment
This repo appears to be a legitimate backup helper, but review before running: 1) git clone the repo and inspect setup.js and install-launchagent.sh (do not run curl | node unless you trust and have reviewed the script); 2) run setup.js with default/local-only and perform a test backup to a local folder first to confirm the staged paths are what you expect; 3) prefer an encrypted rclone remote (rclone crypt) or encrypt archives yourself before cloud upload; 4) on macOS the installer may prompt for sudo only to remove an old system LaunchDaemon — confirm the prompt and that you want that behavior; 5) verify the generated LaunchAgent plist / crontab / Task Scheduler entry after install and know how to remove it (unload plist / remove cron line / delete scheduled task) if desired.Like a lobster shell, security has layers — review code before you run it.
latestvk97e6qqzec60bdqyc2r3mqj46n80xqxd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.