Is hopyky/update-plus safe?
https://github.com/openclaw/skills/tree/main/skills/hopyky/update-plus
This is a comprehensive backup and update tool for OpenClaw environments that appears legitimate and well-implemented. While it has extensive system access capabilities including backup creation, remote storage uploads, and automatic updates, all functionality aligns with its stated purpose as a system administration tool.
Category Scores
Findings (5)
MEDIUM Remote Backup Upload Capability -15 ▶
The skill includes functionality to upload backups to remote storage via rclone, which could potentially be misused to exfiltrate sensitive data if configured maliciously. However, this requires explicit user configuration and is disabled by default.
MEDIUM Extensive System Access and Code Execution -25 ▶
The skill contains substantial executable code (700+ lines of bash scripts) with broad system access including file operations, network calls, cron job management, and package manager operations. While legitimate for a backup tool, this represents significant execution capabilities.
MEDIUM Broad File System Access for Backups -10 ▶
The backup functionality accesses potentially sensitive directories including ~/.openclaw config, workspace files, and skills directories. This is necessary for backup operations but provides access to sensitive configuration data.
LOW Automatic Update Mechanism -15 ▶
The tool includes automatic update functionality that could potentially install malicious content if the update sources were compromised. However, it uses standard git and package manager operations.
INFO Network Connections During Installation -10 ▶
The skill makes expected network connections to GitHub for git operations during installation. All connections appear legitimate and related to the tool's functionality.