安全扫描
OpenClaw
安全
high confidenceThe skill is an instruction-only helper for rsync/rclone-style file synchronization and its requested resources and instructions are consistent with that purpose.
评估建议
This skill is a text-only set of best-practices for using rsync/rclone/unison — it does not include code or request credentials. Still, be mindful: if you let an agent execute these commands, those commands can read and modify local files and contact remote hosts. Before running any destructive sync (especially with --delete or rclone sync), run --dry-run and inspect the exact command the agent will run. Ensure rsync/rclone on your system are the versions you expect, and never let the agent hard...详细分析 ▾
✓ 用途与能力
Name and description match the SKILL.md. The only runtime requirements declared are rsync or rclone binaries, which are exactly what a sync helper would need.
✓ 指令范围
SKILL.md contains concrete, narrowly-scoped guidance for rsync, rclone, unison, and SSH usage. It does not instruct the agent to read unrelated system files, harvest credentials, or post data to unexpected endpoints. It explicitly advises not to hardcode cloud credentials.
✓ 安装机制
No install spec and no code files — this is instruction-only, so nothing is downloaded or written to disk by the skill itself.
✓ 凭证需求
The skill declares no environment variables or credentials, and the instructions only reference normal user paths (e.g., ~/.ssh/key) appropriate for SSH-based sync. No unrelated secrets are requested.
✓ 持久化与权限
Skill is not always-enabled and does not request persistent modifications. It relies on user-invoked commands and therefore does not require elevated or permanent privileges.
安全有层次,运行前请审查代码。
运行时依赖
🖥️ OSLinux · macOS · Windows
版本
latestv1.0.02026/2/12
Initial release
● 无害
安装命令 点击复制
官方npx clawhub@latest install sync
镜像加速npx clawhub@latest install sync --registry https://cn.clawhub-mirror.com
技能文档
rsync Fundamentals
- Trailing slash matters:
rsync src/copies contents,rsync srccopies the folder itself — this is the #1 cause of wrong directory structures - Always use
-avzbaseline: archive mode preserves permissions/timestamps, verbose shows progress, compress speeds transfers - Add
--deleteonly when you want destination to mirror source exactly — without it, deleted source files remain on destination - Use
--dry-runbefore any destructive sync — shows what would change without modifying anything
Exclusions
- Create an exclude file instead of multiple
--excludeflags:rsync -avz --exclude-from=.syncignore src/ dest/ - Standard excludes for code projects:
.git/,node_modules/,__pycache__/,.venv/,*.pyc,.DS_Store,Thumbs.db - Exclude patterns are relative to source root —
/logs/excludes only top-level logs,logs/excludes logs/ anywhere
Cloud Storage (rclone)
rclone syncdeletes destination files not in source;rclone copyonly adds — use copy when unsure- Configure remotes interactively:
rclone config— never hardcode cloud credentials in scripts - Test with
--dry-runfirst, then--progressfor visual feedback during actual sync - For S3-compatible storage, set
--s3-chunk-size 64Mfor large files to avoid timeouts
Verification
- After critical syncs, verify with checksums:
rsync -avzcuses checksums instead of size/time (slower but certain) - For rclone, use
rclone check source: dest:to compare without transferring - Log sync operations to file for audit:
rsync -avz src/ dest/ | tee sync.log
Bidirectional Sync
- rsync is one-way only — for true bidirectional sync, use unison:
unison dir1 dir2 - Unison detects conflicts when both sides change — resolve manually or set prefer rules
- Cloud services like Dropbox/Syncthing handle bidirectional automatically — don't reinvent with rsync
Remote Sync
- For SSH remotes, use key-based auth:
rsync -avz -e "ssh -i ~/.ssh/key" src/ user@host:dest/ - Specify non-standard SSH port:
-e "ssh -p 2222" - Use
--partial --progressfor large files over unreliable connections — allows resume on failure
Common Pitfalls
- Syncing to mounted drives that unmount silently creates a local folder with the mount name — verify mount before sync
- Running sync without
--deleterepeatedly causes destination to accumulate deleted files forever - Time-based sync fails across machines with clock skew — use
--checksumfor accuracy or sync NTP first
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制