by 安全扫描
OpenClaw
可疑
medium confidenceThe skill largely does what its description says (creates a full-system archive and uploads via rclone) but contains several incoherencies and risky choices (hardcoded user path, sudo usage, and collection of sensitive system files) that you should review before installing or running.
评估建议
Before installing or running this skill: 1) Inspect and edit the script — change PARENT_DIR to the intended path or make it configurable; remove or review copying of /etc/tailscale and any systemd files if you do not want service credentials backed up. 2) Understand sudo: the script uses sudo to copy system files; run it in a controlled environment or grant sudo only when you review the commands. 3) Rclone configuration: the script expects a remote called 'gdrive' (gdrive:OpenClaw_Backups). Ensu...详细分析 ▾
⚠ 用途与能力
The declared purpose (full-system backup to cloud) matches what the script does, but the implementation contains unexplained hardcoding and platform assumptions: PARENT_DIR is fixed to /home/jackie_chen_phong (not configurable), the rclone remote name 'gdrive' is hardcoded, and the SKILL metadata declares no required binaries or env vars even though the script requires sudo, tar, rclone, apt/pip/crontab utilities. Those omissions reduce coherence between stated requirements and actual needs.
⚠ 指令范围
The script accesses many sensitive items: ~/.bashrc, ~/.profile, ~/.config, system package lists, pip packages, crontab, and system files such as /etc/tailscale and /etc/systemd/system/openclaw*. Collecting and archiving these is consistent with a 'full backup' goal, but it will capture credentials/configuration that could be sensitive (e.g., Tailscale keys or service unit files). The SKILL.md does not warn that sudo is required to read system files nor emphasize reviewing which files will be included.
ℹ 安装机制
This is an instruction-only skill with no install spec, which is low-risk from an installation perspective. The README suggests installing rclone/tar via apt, but there is no automated installer. That's acceptable, but users should be warned that following the suggested apt commands will change system state (install packages) and must be run with sudo.
⚠ 凭证需求
No environment variables or credentials are declared in metadata, yet the script implicitly depends on a preconfigured rclone remote (named 'gdrive') and uses sudo to read system files. The skill will archive tokens/configuration stored in the filesystem (rclone config, Tailscale files, systemd service files) without declaring or constraining access — this is disproportionate relative to the metadata and increases risk of unintended secret exfiltration.
ℹ 持久化与权限
The skill is not always-enabled and does not request persistent platform privileges. However, it requires elevated file-read privileges (via sudo) at run time to collect system config, and it writes backups to the user's backups directory and deletes old archives. These actions are within a backup's scope but should be explicit and require user consent.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/3/12
Thêm tính năng sao lưu tập tin người dùng trực tiếp trong home dir, loại trừ file log.
● 可疑
安装命令
点击复制官方npx clawhub@latest install backup-full-system-jaskies
镜像加速npx clawhub@latest install backup-full-system-jaskies --registry https://cn.longxiaskill.com