Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenClaw Migration
v1.0.1Shared OpenClaw skill for guiding ClawMover backup and restore workflows with explicit confirmation, input validation, and a manual-command-first execution p...
⭐ 0· 96·0 current·0 all-time
by@tubo70
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the instructions: the skill guides backups/restores, checks for the clawmover CLI, validates inputs, and requires explicit confirmation before actions. No unrelated capabilities or credentials are requested.
Instruction Scope
SKILL.md stays within scope: it explains checks to run, input validation rules, and when to run or show commands. It does not instruct reading unrelated files, environment variables, or posting data to external endpoints beyond the expected clawmover site reference.
Install Mechanism
There is no install spec in the package (instruction-only). The runtime text references installing @clawmover/cli and correctly requires explicit user confirmation before installation. This is acceptable, but installing the CLI will fetch third-party code (e.g., from npm) — users should inspect that package/source before consenting.
Credentials
The skill requests no environment variables or host config paths. It accepts sensitive inputs (dataSecretKey, 6-digit codes) from the user but includes clear handling rules (masking, no logging, no storage). The sensitivity is proportional to the stated tasks.
Persistence & Privilege
always is false and the skill does not request persistent system-level privileges or modify other skills/config. It explicitly disallows silent installs or silent execution, which keeps its privilege footprint minimal.
Assessment
This skill is coherent and conservative, but before you install or let it run commands: (1) prefer the manual-install option and review the @clawmover/cli package/source (e.g., npm/github) so you know what code will be executed; (2) never paste long secret keys into chat unless necessary — follow the skill's guidance on masking and confirm it won’t be stored; (3) when asked to run commands that modify your system (real restore, global installs), use the manual command option or verify the exact command before allowing the agent to execute it.Like a lobster shell, security has layers — review code before you run it.
latestvk977r4thx0r118a0aw4vfsmvxh84qw39
License
MIT-0
Free to use, modify, and redistribute. No attribution required.