ClawHub
Back to skill

Security audit

Migrator

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate migration tool, but restoring an archive can write broadly into the user’s home directory without enough containment.

Use this only for archives you created or fully trust. Treat .oca files as secret backups because they may contain auth tokens, memory, skills, and local path metadata. Before importing, back up existing OpenClaw files or restore to a temporary destination first, and verify the installed tar dependency is patched.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The manifest embeds environment metadata including the user's home directory and workspace path inside the archive. Even though the archive is encrypted, these fields increase the sensitivity of the backup by exposing local filesystem layout and potentially user-identifying information if the archive is later shared, mishandled, or decrypted on another system.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Lucas <lucas.xuan>",
  "license": "MIT",
  "dependencies": {
    "archiver": "^7.0.0",
    "tar": "^7.4.3",
    "fs-extra": "^11.2.0",
    "commander": "^12.0.0"
Confidence
95% confidence
Finding
The dependency is specified with a caret range, which allows newer minor or patch versions to be installed over time. This weakens build reproducibility and can unexpectedly introduce malicious or vulnerable upstream changes into a security-sensitive migration tool.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "archiver": "^7.0.0",
    "tar": "^7.4.3",
    "fs-extra": "^11.2.0",
    "commander": "^12.0.0"
  }
Confidence
97% confidence
Finding
Using a caret range for tar allows automatic adoption of later releases within the major version, reducing deterministic builds. In a tool that handles migration archives, supply-chain drift is especially relevant because archive-processing code is security sensitive.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "archiver": "^7.0.0",
    "tar": "^7.4.3",
    "fs-extra": "^11.2.0",
    "commander": "^12.0.0"
  }
}
Confidence
95% confidence
Finding
The fs-extra dependency is not strictly pinned, so installs may vary across time and environments. This creates avoidable supply-chain exposure and makes it harder to audit exactly what code is executed during migration operations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"archiver": "^7.0.0",
    "tar": "^7.4.3",
    "fs-extra": "^11.2.0",
    "commander": "^12.0.0"
  }
}
Confidence
94% confidence
Finding
The commander dependency uses a caret range, permitting dependency drift between installations. While common in development, this is still a real supply-chain hardening weakness for a CLI that may run with access to sensitive agent data and local files.

Known Vulnerable Dependency: tar==7.4.3 — 7 advisory(ies): CVE-2026-24842 (node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Trave); CVE-2026-26960 (Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in no); CVE-2026-23745 (node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Ins) +4 more

High
Category
Supply Chain
Confidence
99% confidence
Finding
The package declares tar 7.4.3, which the finding reports as having multiple archive-handling vulnerabilities including path traversal, hardlink/symlink abuse, and arbitrary file overwrite/read conditions. In a migration skill that likely imports or extracts archives containing agent config, memory, and skills, this context makes the issue more dangerous because a crafted archive could write outside the intended destination or tamper with sensitive files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.