360 Secure SkillHub
360 安全技能中心

OpenClaw Backup

这是OpenClaw代理/工作区的备份恢复工具，核心功能为创建两层备份：云安全的操作备份（不含秘钥）、可选age加密的秘钥备份（本地恢复用）。支持备份、验证、恢复、推送操作归档到GitHub，适用于灾备设置、代理备份、备份完整性验证、恢复及预变更快照等场景。通过bash脚本加参数操作，恢复前需用--dry-run验证，需依赖age（加密秘钥）、gh（GitHub推送）工具，遵循秘钥加密后才传输的安全规则。

zurbrick
zurbrick
热度 51.79
最近更新 2026-05-11 17:34:06
分类：自动化依赖：代码执行 / 读写文件应用场景：自动化脚本 / 工作流 / 任务管理

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add openclaw-backup-zurbrick
Metadata
name
openclaw-backup
description
Encrypted backup and restore for OpenClaw agents. Creates two-tier archives: cloud-safe operational backups plus optional age-encrypted secrets for local recovery. Use when setting up disaster recovery, backing up your agent, verifying backup integrity, restoring from backup, or pushing safe archives to GitHub.

OpenClaw Backup

Use this skill for backup, verify, restore, and disaster-recovery workflows for an OpenClaw workspace.

Use when

  • setting up backup and restore for an OpenClaw agent or workspace
  • creating a cloud-safe operational backup
  • creating an encrypted secrets backup for local recovery
  • verifying a backup set before trusting it
  • dry-running or executing a restore
  • pushing an operational backup archive to GitHub

Do not use when

  • the user wants general file sync or generic backup advice unrelated to OpenClaw
  • you only need a one-off copy of a few files
  • secrets would be pushed or shared without encryption
  • the restore target or archive path is unclear

Default workflow

  1. Identify the job Choose one lane:

    • backup
    • verify
    • restore
    • push operational archive to GitHub
    • schedule / drill / pre-change snapshot

  2. Start with the core path Use the main scripts first:

    • bash {baseDir}/scripts/backup.sh
    • bash {baseDir}/scripts/verify.sh --manifest <path>/manifest.json --archive <path>/backup.tar.gz
    • bash {baseDir}/scripts/restore.sh --manifest <path>/manifest.json --archive <path>/backup.tar.gz --dry-run
    • bash {baseDir}/scripts/push-to-github.sh --manifest <path>/manifest.json --archive <path>/backup.tar.gz

  3. Keep the archive model straight Default to operational-only backups for cloud storage. Secrets are opt-in and must stay encrypted with age.

  4. Use dry-run before restore Restore is high-blast-radius. Prefer --dry-run before a real restore.

  5. Load references only as needed

    • references/restore-guide.md — full disaster recovery walkthrough
    • references/what-to-backup.md — file coverage and rationale
    • references/retention-policy.md — retention guidance
    • references/workflows.md — weekly verify, monthly drill, pre-change snapshot, CI

Archive model

Tier Contents Cloud safe? Encrypted?
Operational Workspace, redacted config, crons Yes No (no secrets)
Secrets .env, agent auth profiles No Required (age)

Default: operational only. Secrets are opt-in via --include-secrets.

Prerequisites

  • age for secrets encryption
  • gh for GitHub push (optional)

Configuration

Set encryption via environment or flags:

export AGE_RECIPIENT="age1your_public_key"
export AGE_PASSPHRASE_FILE="/path/to/passphrase"

bash {baseDir}/scripts/backup.sh --include-secrets --age-recipient age1...

Safety rules

  • Never push secrets unless they are encrypted
  • Prefer verify before restore, and dry-run before live restore
  • Treat restore as destructive until proven otherwise
  • If paths or archive contents are ambiguous, stop and clarify

References

  • {baseDir}/references/restore-guide.md
  • {baseDir}/references/what-to-backup.md
  • {baseDir}/references/retention-policy.md
  • {baseDir}/references/workflows.md