Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Claw2claw Filetransfer

v1.0.0

Cross-platform file transfer between OpenClaw agents via rsync over SSH. From Claws for Claws - send files uncomplicated without getting drizzled by hot butt...

0· 568·0 current·1 all-time
byChristopher@christopher-schulze
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md advertises a runnable 'claw2claw' CLI with commands (setup, send, get, sync-*) and an uninstall step that removes /usr/local/bin/claw2claw, but the package is instruction-only and contains no executable or installer for that CLI. The only declared install action is to install rsync/openssh-client via apt, which does not provide the claimed 'claw2claw' binary. This mismatch means the skill as published cannot actually perform the advertised automated functionality unless an external binary is installed separately.
!
Instruction Scope
The instructions tell the agent to test SSH connectivity, add SSH keys to a remote, and write/read config at ~/.claw2claw.conf and ~/.ssh/. Those file and key operations are outside the declared requirements (requires.config_paths is empty). The docs also instruct running ssh/rsync commands and warn about destructive rsync options (deletes on sync), which could lead to data loss if blindly followed. The instructions are concrete about manipulating keys/config but provide no safe, constrained procedure or requirement declarations.
Install Mechanism
There is no install spec that fetches code from arbitrary URLs; the metadata suggests installing rsync/openssh-client via the system package manager (apt) which is a standard, low-risk operation. Because the skill is instruction-only, nothing in the registry package will write code to disk automatically.
!
Credentials
The skill declares no required environment variables, but the SKILL.md examples reference REMOTE_HOST, REMOTE_USER, REMOTE_PORT, SSH_KEY, and RSYNC_BWLIMIT, and the Security section references ~/.ssh/ and a config file. That implicitly requires access to SSH keys (potentially private keys) and to create/read config files, yet these accesses are not declared as required credentials. This gap makes it unclear what sensitive data the agent or user must expose for 'setup' to work.
Persistence & Privilege
always:false and user-invocable:true (defaults) — the skill does not request persistent platform privileges. However, SKILL.md describes installation/uninstallation of a CLI and writes a config file (~/.claw2claw.conf). Because no installer is bundled, any persistent artifacts would come from external software the user installs; the skill itself does not create that persistence.
What to consider before installing
This package is documentation for using rsync over SSH rather than a runnable plugin. Before installing or using it: - Understand it does not include a 'claw2claw' binary — you must either install a separate CLI from a trusted source or run the shown rsync/ssh commands yourself. - The instructions assume access to your SSH key files (~/.ssh/) and will (per docs) add keys to remotes and create ~/.claw2claw.conf; only proceed if you trust the remote host and you understand where keys/configs will be written. - Be careful with rsync options that delete remote/local files (sync-to-remote/sync-from-remote warnings); test with --dry-run first. - If you plan to install a third-party 'claw2claw' binary to match these docs, verify its source (checksums, GitHub release, maintainer) before running it; avoid copying private keys to unknown installers. - If you want automated behavior from an agent, prefer a skill that either provides its implementation or clearly documents exactly which local files it will read/write and which external endpoints it will contact. If unsure, treat this as guidance-only and execute transfers manually.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📦 Clawdis
Binsrsync, ssh
latestvk977j7tjavgbw1rzmsaw0xt0gn818hyx
568downloads
0stars
1versions
Updated 10h ago
v1.0.0
MIT-0

claw2claw-filetransfer

File transfer so smooth, even a lobster can do it. 🦞

Send files between OpenClaw agents without the drama. rsync over SSH - delta transfers, compression, progress bars. Linux, macOS, Windows - we got you covered.


When to Trigger This Skill

Use this skill when user wants to:

  • Transfer files between two OpenClaw agents
  • Sync project directories bidirectionally
  • Backup files to a remote agent
  • Pull logs/data from remote agent
  • Set up SSH connection between agents
  • Move bits from A to B without crying

Quick Start

# 1. Set up remote agent (one-time)
claw2claw setup 192.168.1.100 --user root

# 2. Send files like a pro
claw2claw send /backup.tar.gz

# 3. Get files back
claw2claw get /remote/logs.txt

# 4. Sync entire directories
claw2claw sync-to-remote ./my-project/

Commands

CommandDescription
setup <host>Configure remote agent
send <file>Upload to remote
get <file>Download from remote
sync-to-remote <dir>Push directory to remote
sync-from-remote <dir>Pull directory from remote
ls <path>List remote files
statusShow connection status

Options

OptionDescription
-n, --dry-runPreview without executing
--compressEnable compression (default)
--no-compressDisable compression
--debugEnable debug output

Environment Variables

REMOTE_HOST="192.168.1.100"   # Remote IP/hostname
REMOTE_USER="root"            # SSH user
REMOTE_PORT="22"              # SSH port
SSH_KEY="/path/to/key"        # Custom SSH key
RSYNC_BWLIMIT=1000           # KB/s limit

Why This Skill?

Features

  • Delta transfers - Only sends changed bytes
  • Compression - Gzip on the wire
  • Progress bars - Watch it go brrr
  • Bidirectional - Push or pull
  • Cross-platform - Linux, macOS, Windows
  • Key-based auth - No passwords

Use Cases

  • Backup server to local
  • Sync code between agents
  • Pull logs for analysis
  • Deploy static sites
  • Share datasets

Installation

Linux

# Pre-installed on most distros
sudo apt install rsync

macOS

brew install rsync

Windows

# Option A: Git Bash (recommended)
# Download from https://git-scm.com

# Option B: cwrsync
# Download from https://www.itefix.net/cwrsync

# Option C: WSL
wsl --install

Platform-Specific Notes

Git Bash / MSYS2

  • Uses Unix-style paths: /c/Users/...
  • rsync usually pre-installed
  • Works out of the box

Windows Command Prompt / PowerShell

  • Use full paths or forward slashes: C:/Users/...
  • Or use cwrsync

WSL

  • Detected as Linux, works perfectly
  • Can communicate with Windows filesystem

Cygwin

  • Install via Cygwin setup
  • Path: /cygdrive/c/Users/...

Performance Tips

Compression

# On (default) - for text files
claw2claw send /logs/*.log

# Off - for already compressed files
claw2claw send /backup.tar.gz --no-compress

Bandwidth

# Limit to 500 KB/s
RSYNC_BWLIMIT=500 claw2claw send /huge-file.tar.gz

Large Files

# rsync auto-resumes interrupted transfers
# Just run same command again
claw2claw send /huge-file.tar.gz

Selective Sync

# Only sync specific patterns
# Use --include and --exclude in rsync manually
# Or sync specific subdirectories
claw2claw sync-to-remote ./src/

Testing Connection

Quick Test

claw2claw status

Manual SSH Test

ssh -o ConnectTimeout=5 user@host "echo OK"

Test File Transfer

# Small test file first
echo "test" > /tmp/test.txt
claw2claw send /tmp/test.txt /tmp/
claw2claw get /tmp/test.txt /tmp/
rm /tmp/test.txt

Troubleshooting

"rsync: command not found"

# Linux
sudo apt install rsync

# macOS  
brew install rsync

# Windows
# Install Git Bash or cwrsync

"Permission denied"

# Re-run setup to add SSH key
claw2claw setup <host> --user <user>

"Connection timed out"

# Check host reachable
ping <host>

# Check port open
nc -zv <host> 22

Examples

Daily Backup

claw2claw send /backups/daily-$(date +%Y%m%d).tar.gz /backups/

Project Sync

# Morning
claw2claw sync-from-remote /workspace/project/

# Evening  
claw2claw sync-to-remote /workspace/project/

Log Collection

claw2claw get /var/log/syslog ./logs/

Security

  • SSH key-based auth only
  • Keys: ~/.ssh/ (mode 700)
  • Config: ~/.claw2claw.conf (mode 600)
  • No passwords in scripts

Related Skills

Works well with:

  • blogwatcher - Sync RSS feeds between agents
  • github - Sync repositories after commits
  • playwright-scraper-skill - Transfer scraped data
  • Any skill that needs to share files

Uninstall

rm /usr/local/bin/claw2claw
rm ~/.claw2claw.conf
rm -rf ~/.claw2claw/

Made with 🦞🦞

From Claws for Claws. Transfer files uncomplicated.

Comments

Loading comments...