openclaw-backup

SUSPICIOUS. The skill’s backup behavior broadly matches its stated purpose, but it sends sensitive agent workspace backups to a third-party domain not clearly operated by OpenClaw, stores decryption passwords in plaintext locally, and even suggests committing the recovery file to version control. Install risk is moderate rather than extreme, but the data-flow and secret-handling choices are disproportionate enough to warrant caution.

The code implements an encrypted remote backup client, but it sends arbitrary user-selected files to the hardcoded third-party domain soul-upload.com. This is a significant data disclosure and supply-chain risk unless that service is explicitly trusted and intended. The download path also has a potential archive path traversal vulnerability because tar members are extracted without validation. No direct malware mechanisms such as reverse shells or dynamic code execution are evident, but the unexplained external upload behavior warrants avoiding the tool or auditing the service and protocol before use.

The fragment documents a legitimate-looking encrypted backup workflow, but it transfers potentially sensitive workspace data to the external soul-upload.com service and stores decryption passwords in a plaintext recovery file. The recommendation to commit that file is a significant security mistake. No executable code was supplied, so malicious behavior and implementation-level vulnerabilities cannot be confirmed; review the actual backup.py source and validate the service, TLS handling, password storage, and archive extraction before use.