Self-healing backup and update system with intelligent rollback. Protects against failed updates by automatically monitoring system health post-update and recovering from backups when needed. Features canary deployment testing, health baselines, smart rollback, and 24/7 automated monitoring. Use when performing critical system updates, managing production deployments, or ensuring high availability of services. Prevents downtime through pre-flight checks, integrity verification, and automatic rec
Security Analysis
high confidenceThe skill's documentation describes broad system-level backup and rollback capabilities but provides no code or vetted install, asks you to fetch an external CLI from an unvetted URL, and the declared requirements do not match the runtime actions it instructs — this mismatch is suspicious and should be investigated before use.
The SKILL.md describes a system-level backup/update tool that performs snapshots, DB dumps, package rollbacks, and multi-server operations — all of which normally require a dedicated binary/service and elevated privileges. However the skill bundle contains no code, no install spec for 'phoenix-shield', and the declared registry metadata lists no required binaries or credentials. That is internally inconsistent: a real self-healing updater would need an installed agent or binaries and privileged access.
The instructions tell the agent/user to run many system-level commands and reference sensitive paths (/var/backups, /usr/lib/node_modules, /root/*.sh), package managers (apt, npm), and DB dumps. They also allow/encourage passing arbitrary commands via --command. Those steps go beyond simple guidance and grant broad discretion to execute privileged operations; the skill does not constrain or document where the 'phoenix-shield' binary comes from or what it does.
There is no formal install spec in the skill bundle. Instead SKILL.md instructs you to install 'OpenClaw CLI' from https://openclawcli.vercel.app/ before using the skill. Directing users to download a CLI from an external/unvetted URL (a vercel.app site) is a risk and should be treated with caution. Additionally, the actual 'phoenix-shield' binary referenced in commands is not provided or described.
The skill declares no required env vars or credentials, but the described operations (backups, DB dumps, multi-server deployments, modifying packages and configs, accessing /root) implicitly require elevated privileges and likely credentials (SSH, DB creds, sudo). The absence of declared credentials and the presence of commands that would need root/secret access is a mismatch and a red flag.
The skill does not request always:true and is user-invocable (normal). However its workflows create persistent artifacts (backups, phoenix-shield.yaml), modify system packages and configs, and invoke hooks in /root — so while it doesn't demand special platform persistence, it does instruct actions that will persist on the host and require careful privilege control.
Guidance
Key things to consider before installing or using this skill: - Source verification: The skill provides no code and no official homepage. It tells you to install a CLI from a vercel.app URL — verify that URL is an official source for the tool before downloading anything. - Missing binary: The SKILL.md assumes a 'phoenix-shield' binary exists, but the bundle doesn't provide it or declare it as a requirement. Ask the publisher where that binary comes from and for a verifiable release (GitHub/GPG-signed release or distro package). - Privilege and secrets: The workflow performs package installs, DB dumps, and touches /root. Only run in controlled/test environments first, and ensure least-privilege (do not run as root unless absolutely necessary and you trust the software). - Arbitrary command execution: Many commands are passed via --command; that enables running arbitrary shell commands. Treat any CLI you install with caution — inspect its source or run it in an isolated environment (VM/container) before production use. - Alternative: Prefer solutions distributed via trusted channels (OS packages, official GitHub releases with checksums/GPG, curated package registries). If you still want to evaluate this skill, request the publisher to supply the binary source, release artifacts, and a reproducible install method. If you cannot verify the origin and contents of the 'phoenix-shield' binary and the OpenClaw CLI linked from the page, do not run these workflows on production systems.
Latest Release
v1.0.1
Changelog for shieldphenix v1.0.1 - Skill renamed from "browser-automation-skill" to "phoenix-shield" and repurposed. - All browser automation functionality and documentation removed; the README.md file deleted. - New documentation and feature set for "PhoenixShield"—a self-healing backup and update system with intelligent rollback, canary deployment, 24/7 monitoring, and smart recovery. - Detailed instructions, command references, workflows, CI/CD examples, and troubleshooting for automated system protection and recovery now provided.
More by @StveenLi
Published by @StveenLi on ClawHub
