Avenger Initiative

The skill claims to be an encrypted GitHub backup/restore, which matches the scripts' functionality, but the registry metadata lists no required binaries or credentials while the scripts clearly require git, gh (GitHub CLI), openssl, and python3 and rely on the user's authenticated GitHub token. That metadata omission is an incoherence: the skill will fail or behave unexpectedly unless the environment has those tools and an authenticated gh session.

SKILL.md and the scripts instruct the agent to read and copy many local files (~/.openclaw workspace, memories, skills) and to show the raw encryption key to the user. The scripts also construct an HTTPS repo URL containing the GH token (REPO_URL with ${GH_TOKEN}) which will pass the token as a command argument to git — this can expose the token to local process listings or logs while the command runs. The SKILL.md statement that backups 'auto-run after any critical config change' is vague and not clearly implemented by the scripts, granting the agent broad discretion to run backups silently. Copying entire skill directories into the vault is reasonable for restoreability but increases the chance of unintentionally committing code that owners consider sensitive.

There is no install spec (instruction-only), and all code is bundled as shell scripts included in the skill. No remote downloads or obscure URLs are used by the skill itself. That reduces supply-chain risk, but the README suggests installing via a third-party CLI (clawhub) or git clone from ProSkillsMD; if you use those install routes, review those sources separately.

The skill implicitly requires access to a GitHub token via the GitHub CLI (gh auth token) and reads the user's openclaw.json (which contains API keys) to encrypt it. The registry metadata declared no required environment variables/credentials but the runtime flow depends on gh being authenticated. The use of the GH token embedded in the repo URL exposes that token temporarily. The skill stores a plaintext encryption key on disk under ~/.openclaw/credentials/avenger.key — this is deliberate but increases local key-management responsibility. Overall the requested environment/credentials are proportionate to backing up to a private GitHub repo, but they are not declared and the token-exposure pattern is a real concern.

The skill does not request always:true and does not modify other skills or system-wide settings. It instructs the agent to run cron-like backups (SKILL.md mentions scheduled daily backups) but does not itself install system crons. Because the agent can invoke the skill autonomously, a compromised agent could cause repeated backups to the configured vault — this increases blast radius but is a platform default rather than a skill-specific escalation.