MyClaw Backup

Trust Score 84/100

Create, download, upload, and restore full OpenClaw instance backups (workspace, credentials, skills, agent history) with an optional local HTTP UI. Requires ca

triggers:backuprestoremigratecreate snapshotopenclaw backuprestore from archivedownload backup

GitHub SKILL.md

What it does

Backs up all critical OpenClaw data (workspace, MEMORY.md, skills, agent files, openclaw.json with tokens, credentials, and session history) into a single encrypted-permissions archive and provides restore and migration workflows. Includes a local HTTP server for browser-based download/upload and scripts to schedule, create, and restore backups.

When to use it

Use this skill when you need a full snapshot for migration, disaster recovery, or offline archival. Also useful for moving an OpenClaw instance to a new host or creating scheduled automatic backups. Follow the security guidance: always run restores in --dry-run mode and never expose the HTTP server without a token and TLS.

What's included

Scripts: backup.sh, restore.sh (with --dry-run), serve.sh (local HTTP UI requiring token), schedule.sh for cron scheduling.
References: Detailed trust boundary and a references/what-gets-saved.md listing exactly what is included/excluded.
Instructions: Step-by-step workflows for creating backups, migrating to a new instance, starting the local server securely, and post-restore recovery reporting.

Compatible agents

Best used by OpenClaw-hosted agents and automation tasks that can run shell scripts and interact with local filesystems (OpenClaw CLI-aware environments).

Audit Summary

MyClaw Backup provides full OpenClaw instance backup/restore with an HTTP UI for browser-based management. Scripts are well-written with proper error handling, security gates (mandatory token auth, localhost-only execution endpoints, chmod 600 on archives), and thoughtful restore workflow (dry-run, pre-restore snapshot, gateway token preservation). Backup.sh mostly succeeded in sandbox but hit a permission error on a .bak file. Other scripts failed due to expected runtime dependencies (archive arg, token requirement, sandbox path issues) — not bugs.

Watch Out

server.js uses execSync with interpolated filenames for backup/restore — path.basename mitigates traversal but this is still a shell injection surface
schedule.sh modifies system crontab directly without explicit confirmation prompt
HTTP server binds 0.0.0.0 by default — fine for LAN but risky if exposed to internet without TLS
Archives contain all credentials (API keys, bot tokens) — security depends on chmod 600 and token-gated access

Notes

Well-designed skill with thoughtful security model. Trust boundary is clearly documented. The localhost-only restriction on execution endpoints is a good security decision. The skill handles a genuine need (disaster recovery for OpenClaw) and does so comprehensively. Minor concern: execSync with string interpolation in server.js for /backup and /restore endpoints, though path.basename provides some sanitization.

Information

Repository: openclaw-backup
Stars: 667

Trust Score

Overall84

Security88

Code Quality82

Architecture78

Usefulness85

Related Skills

Development Worktree

Create an isolated git worktree for feature work, auto-run project setup, and verify a clean test baseline before development.

Readwise Reader Document Management

Manage Readwise Reader documents: list, save, search, move, tag, highlight, export and bulk-edit via official and custom CLIs.

Bounty Hunter — Atlas

Persona skill: 'Atlas' — a profit-focused developer persona for discovering, evaluating and executing paid bounties or freelance tasks with ROI-aware workflows.

Junshi — Research Advisor

Daily strategic research advisor that scans arXiv/venues, digests papers, and proposes bold, ranked research ideas tailored to the user's profile.

TradeOS

Natural-language driven CEX trading and portfolio management for agents: API key vaulting, multi-exchange orders, DCA, arbitrage scanning, alerts and security r

Full Stack Builder

End-to-end builder that scaffolds, implements, tests, and optionally deploys web and API applications from a natural-language specification.

ezBookkeeping API Tools

Command-line API tools for ezBookkeeping: record and query transactions, retrieve accounts/categories/tags, and fetch exchange rates for self-hosted personal fi

Feishu Voice Sender

Convert MP3s and send them as native Feishu voice messages (playable voice clips) to users or groups.

Back to Skills