by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it claims, but it performs privileged, system-level changes on your VPS and local machine. Before running anything: 1) manually review the three scripts (setup_vps_vsftpd.sh, setup_vps_retention.sh, setup_local_pull.sh) and the troubleshooting notes; 2) run the VPS script only on a machine you control (it installs packages, creates a system user, writes /etc/vsftpd.conf, opens firewall ports, and prompts to set a password); 3) ensure rsync/ssh/systemd/realpath/flock...详细分析 ▾
✓ 用途与能力
Name/description match the scripts and SKILL.md: they configure a VPS FTP ingest (vsftpd + firewall), provide a local systemd-timered pull script using SSH/rsync, and install a VPS retention job. Nothing required or installed is unrelated to providing off-site camera backups.
ℹ 指令范围
Instructions ask operators to run three scripts (VPS setup, retention cron install, local pull installer). They legitimately read/write system paths (/etc/vsftpd.conf, /srv/reolink, /etc/ssl, systemd user files, crontab, authorized_keys when troubleshooting). The troubleshooting guide includes commands that edit authorized_keys and user/group membership; these are within the operational scope but are privileged operations that deserve review before execution.
ℹ 安装机制
No install spec for the skill bundle itself; the included scripts run native package manager commands (apt install vsftpd, ufw, openssl) and write system config files. This is expected for the stated purpose, but the skill did not declare required binaries (rsync, ssh, systemctl, realpath, flock, openssl, ufw, apt), so operators should verify those are present before running.
✓ 凭证需求
The skill does not request external API keys or hidden credentials. It expects the operator to supply a VPS host, an SSH key path, and to set an FTP user password interactively. Those credentials are proportional to the task; the README explicitly recommends using a dedicated, restricted SSH key for the relay.
✓ 持久化与权限
The skill does not request always:true or other elevated platform privileges. It writes local systemd user units and enables a user timer, and modifies a VPS crontab — these are expected for a scheduled pull/retention workflow and are scoped to the operator's machines.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.3.02026/3/14
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install reolink-remote-backup
镜像加速npx clawhub@latest install reolink-remote-backup --registry https://cn.longxiaskill.com