Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Session Daily Backup - Obsidian

v1.0.0

自动每日凌晨备份 OpenClaw 会话到 Obsidian,以增量方式合并多 session,并支持 Token 监控与 QQ 警告。

0· 105·0 current·0 all-time
by小月月@valuemoon2025

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for valuemoon2025/session-daily-backup-obsidian.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Session Daily Backup - Obsidian" (valuemoon2025/session-daily-backup-obsidian) from ClawHub.
Skill page: https://clawhub.ai/valuemoon2025/session-daily-backup-obsidian
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install session-daily-backup-obsidian

ClawHub CLI

Package manager switcher

npx clawhub@latest install session-daily-backup-obsidian
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The scripts read OpenClaw session JSONL files and write markdown snapshots to an Obsidian Vault—exactly what a session backup tool should do. Optional QQ notifications and token-count monitoring are coherent with the description.
Instruction Scope
Instructions and scripts operate on local session files and write markdown into the Vault and tracking directory. They do not attempt to transmit full session contents to external endpoints by default; only short warning messages may be sent via openclaw message or a user-provided QQ_BOT_URL. However, scripts reference absolute paths (e.g. /root/.openclaw, /root/clawd, /root/clawd/format_message_v2.jq.txt) which may be unexpected and require root access or path adjustments.
Install Mechanism
This is an instruction-only skill with no install spec. No remote downloads or package installs are performed by the skill bundle itself.
Credentials
The skill declares no required environment variables, which matches the registry metadata, but runtime scripts expect optional variables/values (e.g. QQ_BOT_URL, QQ_USER_ID) and may call 'openclaw' or curl if configured. README/SKILL.md list different QQ variable names (QQ_APPID/QQ_SECRET) than the scripts actually use—this mismatch should be fixed to avoid misconfiguration. The script’s defaults point at root-owned paths, which may require elevated file access.
Persistence & Privilege
The skill is not always-enabled and does not request special platform privileges, but its defaults reference /root locations and will read session files under the OpenClaw directory. Granting it access to the session directory gives it full visibility into conversation history (which is expected for a backup tool) — be deliberate about which account runs the cron job and which directories are accessible.
Assessment
This skill appears to do what it says (local backups + optional QQ warnings) but take these precautions before installing: - Inspect and adapt the config file: change SESSION_DIR, VAULT_DIR, and TRACKING_DIR to paths appropriate for your system and user (avoid running as root unless intentional). - Fix variable/path mismatches: SKILL.md/README list QQ_APPID/QQ_SECRET, while scripts check QQ_BOT_URL and QQ_USER_ID and expect format_message_v2.jq under the tracking dir. Ensure format_message_v2.jq (or .txt) is placed where the scripts expect or update the script paths. - Permissions: the scripts read session files (sensitive conversations). Only grant read access to the account that will run these scripts. - External endpoints: if you configure QQ_BOT_URL, verify the URL is a trusted QQ API endpoint; the skill may POST short warning messages there. The scripts do not upload full session content to remote servers by default, but misconfiguring the send function could leak info—review and test send_qq_warning before enabling. - Test manually: run scripts by hand from a safe test session directory to confirm outputs and behavior before adding to cron. If you want, I can produce a corrected config template and a small checklist of edits to make the scripts safe for your environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cfd3mswxk1eprp3cnym7ybs83bf59
105downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Session Daily Backup - Obsidian

自动备份 OpenClaw 会话对话到 Obsidian Vault,支持增量备份、多 session 合并、Token 监控和 QQ 警告通知。

功能

  • 📦 每日自动备份:凌晨 2 点自动执行(cron 定时任务)
  • 📝 增量备份:只保存新增对话,避免重复
  • 🗂️ 多 Session 合并:备份当天所有 session 文件到一个每日文件
  • 🎨 Obsidian 格式:使用 callout 格式,支持彩色对话区分
  • ⚠️ Token 监控:80%/90% 阈值警告,通过 QQ 推送通知
  • 📊 统计信息:Token 估算、行数统计、session 数量

配置

编辑 config 文件:

# Obsidian Vault 路径
VAULT_DIR="$HOME/Documents/Obsidian/Clawd Markdowns"

# Session 文件存储路径
SESSION_DIR="/root/.openclaw/agents/main/sessions"

# 跟踪文件路径
TRACKING_DIR="/root/clawd"

# QQ Bot 配置(可选,用于警告通知)
QQ_APPID=""
QQ_SECRET=""
QQ_USER_ID=""

使用

手动备份

# 完整快照(所有 session)
bash /root/.openclaw/workspace/skills/session-daily-backup-obsidian/scripts/save_full_snapshot.sh [主题名]

# 按小时整理
bash /root/.openclaw/workspace/skills/session-daily-backup-obsidian/scripts/create_hourly_snapshots.sh YYYY-MM-DD

# 监控并自动保存(每日增量备份)
bash /root/.openclaw/workspace/skills/session-daily-backup-obsidian/scripts/monitor_and_save.sh

设置定时任务

# 编辑 crontab
crontab -e

# 添加每日凌晨 2 点备份
0 2 * * * bash /root/.openclaw/workspace/skills/session-daily-backup-obsidian/scripts/monitor_and_save.sh >> /root/clawd/backup.log 2>&1

输出文件

  • 每日备份$VAULT_DIR/YYYY-MM-DD-daily.md
  • 完整快照$VAULT_DIR/YYYY-MM-DD-HHMM-[主题].md
  • 小时快照$VAULT_DIR/YYYY-MM-DD/HH-mm.md
  • 跟踪文件$TRACKING_DIR/.last_snapshot_timestamp(记录上次备份行数)

依赖

  • jq - JSON 处理
  • bash - Shell 环境
  • OpenClaw session 文件(JSONL 格式)

注意事项

  • 首次运行会创建完整的每日备份文件
  • 后续运行仅追加新增对话(≥10 条新消息触发)
  • Token 警告只会发送一次,直到 token 数回落后重新触发
  • QQ 通知需要配置 QQ Bot 或使用 openclaw message 命令

Comments

Loading comments...