by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This package appears to do what it says (create/validate/pack agent migration bundles), but exercise caution before running the included scripts: 1) Review scripts/generate-pack.py and scripts/migrate.py source before executing to confirm they do not send data externally or read secrets. 2) Treat any generated package as potentially sensitive — inspect and redact (replace API keys, passwords, personal contact info) before sharing. 3) Verify any contacts in relations.json have consented to be exp...详细分析 ▾
ℹ 用途与能力
Name/description match the contents: templates for identity, memory, relations, skills, style and scripts to generate/pack/validate migration bundles. The required resources declared (none) are proportionate to the stated purpose.
ℹ 指令范围
SKILL.md instructs running local Python scripts (generate-pack.py, migrate.py) to build/validate/pack migration bundles. The documentation explicitly maps template fields to agent files and conversation history (USER.md, MEMORY.md, AgentLink history, Coze settings). That is within migration scope but implies reading potentially sensitive local agent data and contact records — the user must ensure only intended files are included and third-party consent is obtained.
✓ 安装机制
No install spec; instruction-only runtime with two included Python scripts. No external downloads or package installs are declared in SKILL.md. Risk is limited to local script execution (no network installs declared), but running unreviewed scripts can still perform arbitrary I/O or network calls.
ℹ 凭证需求
The skill declares no required environment variables or credentials (good). However templates and README explicitly handle highly sensitive fields (owner, memory, contacts) and mention reading platform-specific files/diaries. The package also mentions API Keys/SECRET.md as out-of-band items — ensure secrets are not embedded in exported files. No unrelated credentials are requested, but sensitive data could be included by users or by scripts if automated discovery is used.
✓ 持久化与权限
always:false and no elevated privileges requested. The package will write files as part of packing, which is expected for a migration tool. It does not claim to modify other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.62026/4/13
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install agent-migration-pack
镜像加速npx clawhub@latest install agent-migration-pack --registry https://cn.longxiaskill.com