v1.6.1 — Security: localhost-only for shell execution endpoints

🦞 MyClaw Backup v1.6.1

Part of the MyClaw.ai open skills ecosystem.

Security fixes

• 🔒 /restore is now localhost-only — even with a valid token, remote clients cannot trigger a restore. Remote access is limited to download and upload only. This limits blast radius if the token is ever leaked.
• 🔒 /backup is now localhost-only — shell execution endpoints restricted to 127.0.0.1 to prevent remote code execution risk.
• 🔒 Web UI hides Restore and Create Backup buttons when accessed from a remote host — shows a clear notice explaining the restriction.
• 📋 schedule.sh now prints the crontab entry before adding it, so users see exactly what persistence is being installed.
• 📋 SKILL.md updated with a detailed access control table showing which endpoints are remote-accessible vs localhost-only.

Access control summary

Endpoint	Remote (token)	Localhost
GET /health	✅ (no token)	✅
GET /backups	✅	✅
GET /download/:file	✅	✅
POST /upload	✅	✅
POST /backup	❌	✅
POST /restore	❌	✅