machine-config-migrator

• Risk level: Low
• Analyzed: Feb 24, 2026, 3:45 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and instructions match its stated purpose (collect and restore selected dotfiles and plugin inventories); nothing requested is disproportionate, but be cautious about running the automatic plugin-install mode because it will fetch and run code from the network.

This skill appears to do what it says: collect selected dotfiles into a tarball and restore them on another machine. Before using it: 1) Run collect on the source machine and inspect the generated bundle (manifest.json and payload/home) to ensure no sensitive files were included. 2) On the target, run apply_config_bundle.py with --dry-run first to see what would change. 3) Be cautious with --plugin-mode run: it will fetch code (git clone, package manager actions, etc.) from the network and execute installers — only use it if you trust the plugin sources listed in the manifest (or prefer to run installs manually after reviewing commands). 4) Keep the backups produced by the tool so you can restore overwritten configs. 5) Do not run these scripts as root; run them as the user whose home directory is being migrated. If you want higher assurance, review the two script files (collect_config_bundle.py and apply_config_bundle.py) line-by-line before use.