Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Backup Strategy
v1.0.0备份策略助手。用于制定数据备份策略、设计备份方案、规划恢复流程。当需要制定备份方案、设计灾备策略时触发。
⭐ 0· 66·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (backup strategy and recovery planning) align with the SKILL.md content: templates, retention policies, backup/restore scripts, and monitoring guidance. The material is appropriate for a 'backup strategy' helper.
Instruction Scope
SKILL.md contains runnable script examples that reference system paths (/backup, /var/log, /data/app) and commands (mysqldump, rsync, aws s3 sync, find -exec rm -rf). Those are expected for backup instructions, but the scripts include unsafe patterns (hardcoded MYSQL_PASS, find ... -exec rm -rf without additional safeguards) and point at an external S3 bucket (s3://mybackup) which would transmit user data off-host if executed. The instructions do not explicitly instruct agents to harvest unrelated system secrets, but the provided examples could lead users or an agent to run privileged operations against system files or external endpoints.
Install Mechanism
Instruction-only skill with no install spec and no code files — minimal install risk. Nothing is downloaded or written to disk by the skill package itself.
Credentials
The skill declares no required environment variables or credentials, yet its examples implicitly require credentials/tools (MySQL credentials, AWS CLI credentials) and hardcode a password (MYSQL_PASS="password"). That mismatch isn't necessarily malicious, but it is a security risk: examples encourage embedding secrets in scripts and syncing to an unspecified remote bucket without discussing credential management, IAM roles, encryption, or bucket ownership.
Persistence & Privilege
Skill is not always-enabled and does not request persistent system presence or modify other skills/configurations. Autonomous invocation is allowed by default (platform normal), but there is no privileged flag like always:true.
What to consider before installing
This skill appears to be a legitimate template for backup strategy, but review and modify the examples before using them:
- Do not use hardcoded credentials (remove MYSQL_PASS="password"); use vaulted secrets, environment variables, or IAM roles and document how to supply them securely.
- Verify ownership of any remote bucket (s3://mybackup) before syncing — otherwise you may upload backups to an uncontrolled external location. Prefer account-specific bucket names, enforce server-side or client-side encryption, and use least-privilege IAM policies.
- Replace unsafe delete patterns with safer retention logic (confirm paths, test in staging, log actions) to avoid accidental data loss.
- Run all scripts in a non-production environment first and perform restore drills to validate procedures.
- Consider adding notes about credential/storage rotation, encryption of backups, access controls, and monitoring/alerting for backup failures.
If you want to let an automated agent use this skill, ensure the agent is explicitly given only scoped credentials and test behavior in a controlled environment. If you need, I can point out specific lines in the SKILL.md to change to make the examples safer.Like a lobster shell, security has layers — review code before you run it.
latestvk971bdz48f5ffdf1j67ganps6983gg09
License
MIT-0
Free to use, modify, and redistribute. No attribution required.