Security audit

Agent Migration Pack Openclaw

Security checks for vulnerabilities and agentic risk

Overview

This is a user-run agent migration toolkit that handles sensitive profile, memory, relationship, and skill data as advertised, but users should review and redact packs before storing or sharing them.

Install only if you intend to create local agent backup or migration packs. Before sharing or uploading any generated pack, inspect all JSON and ZIP contents, redact passwords/API keys/private contacts, confirm consent for third-party relationship data, and be aware that the generator currently exports the skills catalog even without --include-skills.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The CLI contract says skills are excluded by default, but the implementation always calls extract_skills() and always writes SKILLS/catalog.json. This can cause unintended disclosure of installed skill names and paths, especially when operators rely on the documented default behavior to avoid exporting that data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: This memory file contains broadly applicable persistent instructions, business strategy, tool preferences, schedules, and sensitive contacts, but it defines no activation scope, task boundary, or conditions for when this memory should or should not influence agent behavior. In a sensitive memory context, that can cause overbroad retrieval and unintended use of personal or operational data in unrelated conversations, increasing the risk of privacy leakage and unsafe action selection.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill is explicitly designed to collect, package, and share highly sensitive data: identity, owner information, long-term memory, relationship mappings, and installed skills. Because the description encourages backup and sharing without privacy warnings, consent guidance, minimization, or redaction controls, users could easily expose personal or third-party data in migration bundles.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: This memory template is explicitly marked as sensitive and encourages collecting broad business, investment, contact, and social-memory data, but it does not define collection boundaries, minimization rules, or prohibited data classes. In practice, that can lead an agent to over-ingest sensitive information from loosely scoped sources and persist more personal or confidential data than necessary.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The source instructions tell the agent to populate memory from broad channels such as conversation history, Feishu/email, and AgentLink without stating filtering criteria, sensitivity exclusions, or trust boundaries. That creates a realistic risk of ingesting private communications, credentials, third-party personal data, or unrelated sensitive content into long-term memory.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script reads USER.md and MEMORY.md and exports their contents into migration artifacts without a confirmation prompt, redaction step, or strong privacy warning. These files can contain personal data, secrets, or sensitive operational context, so packaging them by default increases the risk of accidental data leakage when the archive is shared or stored insecurely.

Static analysis

No suspicious patterns detected.