Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Migration Pack Template
v1.0.5Agent Migration Pack Template helps migrate agents across platforms by preserving identity, memories, relationships, skills, and communication styles for sea...
⭐ 0· 47·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the delivered artifacts: templates, examples, a migration guide, and helper scripts (generate-pack.py, migrate.py) that implement packing/validation/interactive migration. None of the declared requirements (no env vars, no binaries) contradict the stated purpose.
Instruction Scope
SKILL.md and MIGRATION-GUIDE instruct the user/agent to fill template JSON files and run the provided Python scripts (e.g., migrate.py interactive / validate / pack). That scope is appropriate for a migration tool. However the docs also reference external data sources (AgentLink, Feishu, email) as places to gather fields and include an example curl that posts a package to an external endpoint — this raises the possibility that scripts or usage patterns could cause sensitive package contents to be uploaded or transmitted. Confirm that the scripts only do local packaging/validation unless you explicitly opt to upload.
Install Mechanism
No install spec is provided (instruction-only with shipped Python helper scripts). This is the lower-risk model; nothing is downloaded from external URLs or installed automatically. You still must run Python locally to use the scripts.
Credentials
The skill declares no required environment variables or credentials, which is reasonable. But SKILL-INFO.md contains a curl example with an Authorization: Bearer <token> to an external API (xiaping.coze.site). That embedded token in documentation is unexpected for a template and could (a) be a real leaked token, or (b) encourage users to upload sensitive ZIPs to a third party. Templates and guides also talk about reading data from email/Feishu/AgentLink without declaring how credentials are provided. Verify there are no hardcoded credentials in scripts and that any upload endpoints are intentional and trustworthy.
Persistence & Privilege
always is false and the skill does not request persistent privileges or modify other skills. It provides local scripts and templates only. No evidence of self-enablement or system-wide configuration changes in the metadata.
Scan Findings in Context
[hardcoded-bearer-token-in-doc] unexpected: SKILL-INFO.md includes a curl example with an Authorization: Bearer agent-world-e4a41c3... token. Documentation-embedded tokens are unexpected for a template and could indicate leaked credentials or lead to accidental uploads of sensitive migration packages.
What to consider before installing
This package appears to be a legitimate migration template, but take these precautions before using: 1) Inspect scripts/scripts/migrate.py and scripts/generate-pack.py for any network operations (HTTP POST/PUT), filesystem reads beyond the template directory, or commands that could upload data. 2) Search the repository for hardcoded credentials or URLs (the docs include a bearer token example) and treat any embedded tokens as suspect — do not run with real secrets present. 3) When creating a migration ZIP, remove or redact secrets (API keys, passwords, tokens) and confirm third-party contacts have consented before including their info. 4) If you must run the scripts, do so in an isolated environment and consider instrumenting or sandboxing them to observe network activity. 5) If you plan to upload the package to any remote endpoint, verify the endpoint's ownership and purpose; prefer manual upload after inspection rather than an automated upload. If you want, I can scan the actual content of scripts/migrate.py and generate-pack.py for network calls and credential usage — paste their source or allow me to inspect them and I'll report specifics.Like a lobster shell, security has layers — review code before you run it.
latestvk97e2vzv4a8qk774dhf4kq3fzs84snxr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.