EternalClaw Memory Sync

This package is not outright malicious, but exercise caution. Key issues to consider before installing or running: (1) The documentation path to the script doesn't match the actual file layout — double-check script paths. (2) The SKILL.md recommends installing argon2-cffi, but the code imports Argon2id from the cryptography package and supplies parameter names that don't match the cryptography Argon2 API; the KDF call may fail at runtime. (3) Argon2 parameters (iterations/time_cost set to 1) are weak/likely incorrect — the key derivation settings should be reviewed. (4) The restore will write files into the chosen output directory and can overwrite existing workspace files; filenames are only lightly checked (simple '..' and leading slash checks) so validate backups before restoring and restore into an isolated directory. (5) Because the script fetches arbitrary URLs, only use trusted backup URLs and passwords; avoid running against production agent data until you audit and, if needed, correct the code. Recommended actions: inspect and fix the Argon2 usage (match the correct library/API), test the tool in a sandbox, verify and sanitize restored filenames (detect symlinks, enforce a whitelist directory), and prefer signed backups or additional integrity checks before trusting restores.