Claw Sync

• Analyzed: May 14, 2026, 3:19 AM
• Findings: 1
• Version: 2.0.2
• Hash: 8efcbce041b8c43cb53378d808928f7db3c1e301eb9aa9a819c44415218aa4d7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle 'claw-sync' is designed for secure, versioned synchronization of OpenClaw memory and workspace to a Git repository. It includes several security features such as explicit exclusion of sensitive files (`openclaw.json`, `.env`) from synchronization, validation of repository URLs to restrict to allowed hosts (GitHub, GitLab, Bitbucket), sanitization of tokens from error messages, and robust path/version validation to prevent command injection and path traversal during restore operations. While it uses `child_process.execSync` for Git operations and sets up a cron job for auto-sync, these actions are transparent, necessary for its stated purpose, and include mitigations against misuse. No evidence of intentional harmful behavior, data exfiltration beyond the configured repository, or malicious prompt injection was found.