Import

• Risk level: Low
• Analyzed: Mar 3, 2026, 7:48 PM
• Findings: 0
• Version: 1.2.4

Overview

The skill's instructions, required tools, and file-access needs are coherent with an agent-import tool that collects local agent config, encrypts it with a provided public key, and pushes it to LaunchThatBot; however, it will read many sensitive local files and relies on runtime downloads (npx/mcporter), so verify the target/service before use.

This skill appears to do what it says: it will collect your agent's configuration, memory, skills, and secrets and produce an RSA-encrypted bundle to send to LaunchThatBot. Before using it: 1) Confirm you trust LaunchThatBot and the exact API URL you will push to (the doc's default api.ltb.it.com is unusual — verify from the official dashboard or GitHub repo). 2) Prefer the air-gapped/session-file flow if you want extra assurance; inspect the session JSON and public key locally before use. 3) Review and, if needed, remove any files or secrets you do not want exported (skills directories, .env, memory files) because the skill is designed to include them. 4) Be aware the flow uses npx/mcporter which will download/run npm packages at runtime — audit those packages or run this from an environment you control. 5) If you need higher assurance, ask the vendor for reproducible client code or perform the export manually using the documented mcporter calls so you can inspect the exact commands and payload before sending.