Wiz Migration
Analysis
The skill appears to be a local Wiz-note migration helper, but users should verify the package files, script path, and copy locations before using it on private notes.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
python bin/wiz-migrate ... scripts/copy_attachments.bat # Windows 批处理脚本
The documentation references runnable helper files, but the provided file manifest does not include bin/wiz-migrate or scripts/copy_attachments.bat. This is a packaging/provenance gap rather than evidence of malicious behavior.
if script_path and os.name == 'nt' and Path(script_path).exists(): return _run_batch_script(...) ... subprocess.run([str(temp_script)], shell=True, ...)
On Windows, the migration function can execute a batch script supplied by path. This is purpose-aligned for attachment migration, but it is still local shell execution.
for root, dirs, files in os.walk(source): ... if d == "_Attachments" or d.endswith("_files"): ... shutil.copytree(attach_dir, dest_path)The tool recursively finds and copies every matching attachment directory under the chosen source path. This is expected for migration, but a mistaken broad source can propagate many files into the target.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
附件复制失败 | 权限不足 | 以管理员身份运行脚本
The troubleshooting table suggests running the script as administrator if copying fails. Elevation is not the default workflow, but it broadens local file access.