dev-backup

Create versioned snapshots of a workspace project during development to enable safe rollback before risky changes or upon user request.

Security Scan

The skill does what it says — a small Bash snapshot script and documentation to create local, numbered project backups — and its requirements and instructions are proportionate and coherent with its purpose.

Purpose & Capability

The name/description match the provided SKILL.md and the included shell script: it creates numbered, local snapshots of a project. It does not request unrelated credentials or services. The script uses common system utilities (rsync, tar, du, ln, mkdir, rm); rsync is optional but reasonable for this task.

Instruction Scope

SKILL.md instructs running the included script and how to restore. The instructions are scoped to reading project files and writing backups to a local backups directory; there are no network calls, no external endpoints, and no instructions to read unrelated system files or secrets.

Install Mechanism

No install spec is provided (instruction-only plus a script file). Nothing is downloaded or extracted at install time. This lowers risk — the script runs only when invoked.

Credentials

The skill requires no credentials or config paths. The script accepts PROJECT_DIR and OUTPUT_DIR via arguments or environment, which is appropriate. It will create files under the chosen backups directory (filesystem write access), which is expected for a backup tool.

Persistence & Privilege

The skill is user-invocable, not forced-always, and does not request persistent agent privileges or modify other skills. It does create/modify files only in the specified output directory.

Assessment

This skill appears coherent and limited to local backup actions. Before installing/running: (1) confirm the OUTPUT_DIR location so backups are not written somewhere unexpected; (2) ensure you have enough disk space for snapshots; (3) install rsync if you want the script's excludes to be applied — the tar fallback does not apply the exclude list (so sensitive files like .env may be copied if rsync is missing); (4) run as a normal user (not root) and review the snapshot directory after the first run; and (5) if you require exclusion of additional sensitive files, update the script accordingly. There are no network calls or credential requests in the skill.

Snapshot the current state of a named project for safe rollback.

Usage

Each project gets its own snapshot numbering. The project name is always the first argument.

# Backup any project
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
bash "$SCRIPT_DIR/dev-backup.sh" <project-name> --project-dir /path/to/your/project

# Example: backup a "my-app" project
bash "$SCRIPT_DIR/dev-backup.sh" my-app --project-dir /home/user/projects/my-app

# No --project-dir? Uses the current working directory
cd /home/user/projects/my-app
bash "$SCRIPT_DIR/dev-backup.sh" my-app

Naming

Snapshots are named per project:

• my-app-snapshot-1, my-app-snapshot-2, …
• another-project-snapshot-1, another-project-snapshot-2, …

Each project tracks its own counter independently.

Excluded from snapshot

• .git, node_modules, .vite, .cache, *.log, .env, backups/

Restore

To restore a snapshot:

cp -r <backups-dir>/<project-name>-snapshot-3/ <your-project-dir>/

Or use the .latest symlink:

cp -r <backups-dir>/.latest/ <your-project-dir>/

Verification

After backup, confirm:

ls -la <backups-dir>/

You should see the project-prefixed snapshot and .latest symlink.