openclaw-backup-rollback Security Report — Trusted | ClawSafe

5 /100

openclaw-backup-rollback

自动备份 + 回滚系统，保护OpenClaw配置安全

Legitimate backup and rollback plugin for OpenClaw with fully declared shell operations and no hidden functionality.

Skill Nameopenclaw-backup-rollback

Duration26.0s

Enginepi

✓

Safe to install

No action needed. The skill performs standard backup/restore operations using tar, gzip, and systemctl as documented.

Findings 1 items

Severity	Finding	Location
Low	Hardcoded user home path backup_openclaw.sh line 3 contains hardcoded path /home/acrdik/.openclaw instead of using $HOME or Path.home() `BACKUP_DIR="/home/acrdik/.openclaw/backups"` → Use $HOME variable for portability: BACKUP_DIR="$HOME/.openclaw/backups"	`scripts/backup_openclaw.sh:3`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`WRITE`	`WRITE`	✓ Aligned	SKILL.md declares backup functionality; code creates tar.gz in ~/.openclaw/backu…
Shell	`WRITE`	`WRITE`	✓ Aligned	SKILL.md declares systemctl/restart; code uses subprocess for tar, systemctl, du
Network	`NONE`	`NONE`	—	No network operations found
Environment	`NONE`	`NONE`	—	No os.environ access found
Skill Invoke	`NONE`	`NONE`	—	No skill invocation found
Clipboard	`NONE`	`NONE`	—	No clipboard access found
Browser	`NONE`	`NONE`	—	No browser operations found
Database	`NONE`	`NONE`	—	No database access found

5 files · 13.3 KB · 422 lines

Python 2f · 270L Markdown 1f · 56L JSON 1f · 50L Shell 1f · 46L

├─ ▾ 📁 scripts

│ ├─ 🔧 backup_openclaw.sh Shell 46L · 1.4 KB

│ ├─ 🐍 backup_rollb_plugin.py Python 126L · 4.3 KB

│ └─ 🐍 rollback.py Python 144L · 4.9 KB

├─ 📋 openclaw.plugin.json JSON 50L · 1.1 KB

└─ 📝 SKILL.md Markdown 56L · 1.5 KB

✓ All shell operations declared and relevant to backup/restore functionality

✓ No credential harvesting or environment variable iteration

✓ No network requests to external IPs

✓ No base64 encoding/decoding or eval() patterns

✓ No hidden instructions in HTML comments

✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)

✓ Proper exclusion of node_modules and logs from backups

✓ Creates pre-rollback backup before restoring

✓ Limited to specific systemd services (openclaw-gateway, vector-search, openclaw-gateway-guardian)

✓ Well-documented in SKILL.md with clear file structure