Openclaw Backup Skill
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files and instructions are coherent with a local backup utility: it bundles a Bash script that archives local OpenClaw workspace and config files and prunes archives; there are no signs of network exfiltration or unexpected privileges, though the backup captures potentially sensitive workspace/identity files and the registry metadata omits some runtime requirements.
This skill appears to be a straightforward local backup/prune script for OpenClaw. Before installing or running it, review and consider the following: - The script will archive workspace contents including assistant identity/continuity files (SOUL.md, AGENTS.md, USER.md). Those files can contain sensitive context — ensure you are comfortable storing them in the chosen backup directory and that the directory has appropriate filesystem permissions and backups are stored securely. - Ensure the target host has the OpenClaw CLI, python3, tar, and other standard utilities the script expects; the registry metadata did not list these requirements, so verify them manually (SKILL.md and the script list the required commands). - The skill is local-only (no uploader) based on the provided files, but you should still scan the full script for any network or external command usage if you have security requirements; the provided content shows no network calls, but the script was truncated in the listing—review the entire script before running it. - When automating (cron/systemd), ask the user for explicit permission before creating or modifying scheduled jobs or automated runs, and choose a secure output directory (default is next to the resolved OpenClaw state dir, e.g., ~/backups/openclaw). - If you need to avoid including identity/continuity files in backups, either modify the script (or ask the user) to exclude them or test dry-run modes first to verify the manifest contents.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.