Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a local backup and restore skill for OpenClaw. It archives the entire ~/.openclaw directory, including configuration, credentials, agent auth profiles, workspace data, Telegram session data, and cron tasks, while excluding the completions cache and log files. A shell script creates compressed tar.gz archives and automatically keeps only the newest 7 backups. Restore instructions stop the gateway, move the current directory aside, extract an archive, and include a rollback command that deletes ~/.openclaw. No runtime network exfiltration, obfuscation, download-and-execute, or persistence mechanism was found. The main review concern is that the backups contain plaintext credentials and the restore/rollback steps are destructive.
| Declared purpose | Backup and restore OpenClaw data, including configuration, credentials, and workspace; create scheduled backups and manage backup rotation. |
| Observed behavior | scripts/backup.sh creates a tar.gz archive of $HOME/.openclaw, excluding 'completions' and '*.log', writes it to $HOME/openclaw-backups by default, reports size/count, and deletes all but the latest 7 archives. Documentation provides cron JSON for daily backup, quick restore steps, and rollback steps. The only domain present is a static publisher link to clawhub.ai; no script or instruction makes network calls. |
| Verdict, rules only | CAUTION · uses sudo, rm -rf or dd |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | Runs bash commands to create backups, stop/start OpenClaw gateway, and remove old archives; SKILL.md line 15, references/restore.md lines 7-20, scripts/backup.sh. |
| filesystem_read | needed | Reads the entire ~/.openclaw directory to create archives; scripts/backup.sh line 15. |
| filesystem_write | needed | Creates backup directories and archives, removes old backups, and can move or delete ~/.openclaw during restore/rollback; scripts/backup.sh lines 9, 15, 21; references/restore.md lines 10, 26-27. |
| credentials | needed | Backs up credentials/, API keys, tokens, agent auth profiles, and Telegram session data; SKILL.md lines 25-28. |
| severity | finding |
|---|---|
| medium | Backups include plaintext credentials The documentation says the archive includes credentials/, API keys, tokens, agent auth profiles, and session data. These are sensitive and are written as a local tar.gz archive without encryption. SKILL.md:25 - `credentials/` — API keys, tokens |
| medium | Archives the entire ~/.openclaw directory The script performs a broad archive of the active OpenClaw directory. The only documented exclusions are 'completions' and '*.log', so credential and session files are included. scripts/backup.sh:15 -C "$HOME" .openclaw/ 2>/dev/null |
| high | Destructive rollback command The rollback procedure deletes ~/.openclaw before moving ~/.openclaw-old back into place. This is documented for recovery, but if executed at the wrong time it destroys the active configuration. references/restore.md:26 rm -rf ~/.openclaw |
| low | Automatic rotation deletes old backups The script removes all openclaw-*.tar.gz files beyond the 7 newest. This matches the claimed rotation behavior and is limited to the chosen backup directory. scripts/backup.sh:21 ls -t "$BACKUP_DIR"/openclaw-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm |
| medium | Known plaintext credential risk The publisher explicitly states that the archives contain plaintext credential/session data and advises restricting access or encrypting archives. This risk is relevant if the agent writes backups to an untrusted location. skill-card.md:24 Risk: Backups include credentials, API keys, tokens, and session data in plaintext archives. |
| info | No runtime network use observed The only domain in the package is this static publisher link. The backup/restore scripts and instructions do not call any network endpoints. skill-card.md:9 [alex3alex](https://clawhub.ai/user/alex3alex) |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | bash, rm -rf |
| Environment variables read | BACKUP_DIR, BACKUP_FILE, COUNT, DATE, HOME, SIZE |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 3 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 68 | 7c2f64ebc1c36f34… |
_meta.json | 6 | ef2553f697ed701f… |
references/restore.md | 46 | 5e710df72ead6d15… |
scripts/backup.sh | 31 | 8c38584aed2567e5… |
skill-card.md | 52 | 00559f61e7b1f2f2… |
For agents
JSON: https://agenteconomy.report/k/openclaw-backup.audit.json · badge: https://agenteconomy.report/k/openclaw-backup.audited.svg ·
skill rating: /k/openclaw-backup · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).