by 安全扫描
OpenClaw
安全
high confidenceThe skill does what it says (creates a local git bundle of the workspace); the included script is short and aligned with the description — no network exfiltration or hidden behavior — but note minor metadata/permission details you should check before installing.
评估建议
What to check before installing/running: 1) Confirm the git CLI is available to the agent (metadata did not list it). 2) Inspect the script (it's short; it only runs git bundle create --all) and confirm you're comfortable letting the agent read the entire workspace repo — the bundle will include all history and refs and may contain secrets. 3) Ensure you want backups written to /root/.openclaw/backups and that there is sufficient disk space and secure storage for the bundles; consider changing t...详细分析 ▾
ℹ 用途与能力
The skill's name, description, SKILL.md, and provided script all consistently implement creating a local git bundle of the workspace. Minor mismatch: the skill metadata lists no required binaries, but the script requires git to be present (git is invoked via the git CLI).
✓ 指令范围
SKILL.md simply instructs running the bundled script. The script only checks that the workspace is a Git repo, creates a backup directory, runs `git bundle create --all`, and prints path/size. It does not call external endpoints, read unrelated system config, or delete other data. Note: the bundle includes all refs/history and therefore may contain sensitive secrets present in the repo.
✓ 安装机制
Instruction-only skill (no install spec). There is a small included script but no downloads or package installs, so nothing is fetched from external URLs and nothing is written to disk aside from the created backup bundle when run.
ℹ 凭证需求
The skill requests no environment variables or credentials (appropriate). It will read the entire workspace repository; that access is necessary for the stated purpose but could expose sensitive repo contents in the resulting bundle. Also the metadata omits declaring the dependency on the git binary.
ℹ 持久化与权限
The script writes persistent files to /root/.openclaw/backups. That is expected for a backup tool, but requires that the agent process has filesystem write access to that path (which often implies elevated or container root permissions). The skill does not modify other skills or system configs and is not set to always:true.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/9
Initial publish
● 无害
安装命令
点击复制官方npx clawhub@latest install gitbackup
镜像加速npx clawhub@latest install gitbackup --registry https://cn.longxiaskill.com✓ 镜像可用