GOG Sync
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: gog-sync Version: 1.1.1 The skill is a utility for syncing GOG game libraries and configurations using rsync. While it contains hardcoded placeholder strings (e.g., 'user@remote' in sync.sh) and a minor discrepancy in dependency naming (gogrepoc vs gogrepo in skill.json), the logic is transparent and strictly limited to game-related directories and specific configuration file types (.ini, .cfg, .json). There is no evidence of data exfiltration, malicious execution, or prompt injection.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If run, the skill can upload local game save data to the configured remote host.
The sync and sync-saves commands recursively copy local save files to a remote rsync destination. This is purpose-aligned for backup/sync, but it is an off-device transfer users should intentionally configure.
rsync -av ~/Games/GOG/saves/ user@remote:/backups/gog/saves/
Verify or edit the rsync destination before running sync or sync-saves, and run the commands only when you intend to back up those files.
The skill may use your existing SSH/remote-host access to write backup files.
A user@host rsync destination normally uses the user's remote account or SSH credentials. This is expected for remote backup, but the registry declares no primary credential, so users should notice the implicit account access.
`GOG_CONFIG_REMOTE` — remote rsync destination (default: `user@remote:/backups/gog/config`)
Use a dedicated backup account or restricted remote path where possible, and confirm which SSH identity rsync will use.
Full library sync may fail or use whatever gogrepo-compatible binary is installed on the system.
The metadata requires rsync, the script invokes gogrepo for full library sync, and skill.json lists gogrepoc, which appears inconsistent. There is no install spec, so users must supply trusted external tools themselves.
"dependencies": ["gogrepoc", "rsync"]
Install rsync and a trusted gogrepo tool manually, and verify the dependency name before relying on full library sync.