Skill Sync

• Verdict: Advisory
• Analyzed: Apr 3, 2026, 3:56 PM
• Findings: 0
• Version: 1.2.1
• Hash: 82e86e9dec3e3574a659a3fea45dd8b6f8db04436ec7f2f022f8585415e87b7d
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: multi-agent-skill-sync Version: 1.2.1 The skill bundle provides a utility for managing, deduplicating, and syncing AI agent skills across various platforms (Codex, Claude, OpenClaw, etc.). The core logic in `scripts/skill_sync.py` performs file system operations such as scanning skill directories, calculating SHA256 hashes to identify duplicates, and replacing redundant copies with symlinks to a canonical source. While the script has broad write access to several agent-related directories in the user's home folder, it includes a robust backup and restore mechanism located in `~/.skill-sync/backups` and lacks any indicators of data exfiltration, network activity, or unauthorized persistence. The behavior is consistent with the stated purpose in `SKILL.md` and `README.md`.