📦 Cloudmigrate — CloudMigrate — 多云迁移与基础设施部署自动化
v1.0.0CloudMigrate 是一款生产级多云迁移和基础设施部署自动化工具，支持 AWS、Azure、GCP 和混合环境。它通过自定义 IaC 工作流程，自动化多云迁移、基础设施部署、策略规划、成本分析、风险缓解和环境配置，减少手动过程，缩短上线时间。
0· 81·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidence该技能的请求 CLI 和云凭证与多云迁移工具一致，但同时请求所有提供商的高权限凭证，并提及未明确说明的外部数据传输/集成（SFTP、Google Drive、Slack、GitHub），需谨慎对待。
评估建议
虽然看似真实的多云迁移助手，但强制要求高权限云凭证，且外部数据传输和集成未声明令牌或安全保障。安装前建议：1) 询问作者是否可选或运行时提示凭证；2) 使用临时、最小权限服务账号/密钥；3) 确认数据上传位置并获取明确同意；4) 在隔离环境测试；5) 审查完整 SKILL.md 和代码，如果无法证明 GCP 服务账号 JSON 和所有提供商秘钥必须同时存在，视为高风险，避免使用真实生产凭证。...详细分析 ▾
ℹ 用途与能力
The declared binaries (terraform, ansible, az, gcloud, docker, aws-cli) and the overall description align with a multi-cloud migration/IaC tool. However, requiring credentials for AWS, Azure, and GCP simultaneously (including a raw GCP service-account JSON) as mandatory environment variables is heavier than most single-use migration tasks normally require. Minor inconsistency: the required binary is listed as 'aws-cli' while the actual executable is usually named 'aws'.
⚠ 指令范围
The SKILL.md explicitly mentions automated SFTP transfers and Google Drive sync plus integrations with Slack and GitHub. Those features imply reading potentially large sets of local data and transmitting them to external endpoints. The skill manifest does not declare Slack/GitHub tokens or specify safe handling/consent flows. Because the skill is instruction-only and the full runtime instructions are truncated, it's unclear what safeguards or explicit user prompts exist before data is moved — this increases risk of unintended data exfiltration.
✓ 安装机制
There is no install specification and no bundled code to write to disk (instruction-only). That lowers install-time risk: nothing is downloaded or executed implicitly by an installer.
⚠ 凭证需求
Requiring AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, AZURE_SUBSCRIPTION_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET, and GCP_PROJECT_ID/GCP_SERVICE_ACCOUNT_JSON as mandatory env vars is disproportionate unless the user intends to run cross-cloud operations in one session. The GCP service-account JSON in an env var is high-sensitivity material. The skill also claims integrations (Slack/GitHub) but lists no corresponding tokens or scopes — a mismatch that could mean the skill expects to use other means to access services or will prompt for credentials at runtime. Either way, humans should only provide scoped, temporary credentials if they proceed.
✓ 持久化与权限
The skill is not marked always:true, does not request config paths, and has no install-time persistence. It does allow normal autonomous invocation (default), which is expected for skills; that alone is not a concern but increases the importance of limiting credentials and reviewing instructions.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSmacOS · Linux · Windows
版本
latestv1.0.02026/3/24
CloudMigrate 技能首次发布，自动化云迁移和 IaC 工作流。支持跨 AWS、Azure、GCP 的多云迁移和基础设施部署，生成 Terraform、CloudFormation、Bicep、Ansible 等 IaC 代码，提供策略规划、成本分析、风险缓解和回滚程序，支持复杂用例和与 Slack、GitHub 的集成。
● 可疑
安装命令
点击复制官方npx clawhub@latest install cloudmigrate
镜像加速npx clawhub@latest install cloudmigrate --registry https://cn.longxiaskill.com
技能文档
概览
CloudMigrate 是一款生产级多云迁移和基础设施部署自动化工具，支持 AWS、Azure、GCP 和混合环境...# ... (完整的 SKILL.md 中文翻译，太长省略)