Quick Resurrection

• Outcome: Review
• Latest audit: May 28, 2026 · 1:48 AM UTC
• Version: 1.0.6

Overview

This migration skill has a real purpose, but it packages private agent data and can restore persistent tasks and configuration, so it needs careful review before use.

Install only if you intend to migrate a full OpenClaw agent environment and you trust the package source. Run migrate.py with --dry-run first, inspect MEMORY.md, TOOLS.md, openclaw-agents.json, included skills, and full cron job payloads, consider --no-cron and --no-restart for the first run, and keep generated migration archives encrypted or otherwise protected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd):
    """执行命令，返回 (stdout, returncode)。仅用于只读操作。"""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout.strip(), result.returncode

# =============================================

• Confidence: 97% confidence
• Finding: `run_cmd` executes arbitrary shell text with `shell=True`, which allows command injection if any untrusted input ever reaches this helper. Although it is documented as read-only, the implementation imposes no restriction on mutating commands, so this helper is a latent RCE primitive in a script that processes external migration packages.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

job_copy["sessionTarget"] = "isolated"
        
        job_json = json.dumps(job_copy, ensure_ascii=False)
        result = subprocess.run(
            ["openclaw", "tasks", "add", "--job", job_json],
            capture_output=True, text=True
        )

• Confidence: 86% confidence
• Finding: The script reads untrusted `cron_jobs.json` from a migration package and forwards each job definition into `openclaw tasks add --job ...`, creating scheduled tasks on the host. Even without shell injection, this is dangerous because an attacker can smuggle persistence or privileged automated actions through crafted job payloads, and the review step only previews a truncated payload.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: Although presented as a cron template, the file embeds an agent payload that performs broad state-changing actions: reading memory and team assets, modifying MEMORY.md, and committing and pushing changes. This turns simple scheduling metadata into an automated privileged workflow, creating risk of unintended data access, persistence changes, and unauthorized repository updates if the template is instantiated without strong controls.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The helper's docstring claims it is for read-only operations, but the code runs arbitrary shell commands with no enforcement. This mismatch can mislead maintainers into passing untrusted or supposedly harmless input to a function that can execute destructive commands, increasing the chance of later exploitation.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring frames the script as only collecting agent materials for packaging, but the implementation also scans common directories under the user's home and records git work directories. That mismatch is dangerous because it broadens data collection beyond the stated scope, reducing user awareness and informed consent during exfiltration of local environment metadata.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script reads ~/.qclaw/cron/jobs.json and exports enabled cron job definitions into the migration package. Cron jobs can encode operational behavior, paths, schedules, and sensitive automation details, so collecting them without clear disclosure expands the package to privileged local configuration data.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The generated README tells users to hand the archive to an agent that will automatically back up configs, merge settings, create cron tasks, and restart a gateway, even though this script only builds the package and copies migrate.py. This misleading narrative encourages users to trust and execute a high-privilege migration workflow without accurately representing what code has or has not been reviewed in this file.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation explicitly packages and transfers highly sensitive agent and user artifacts, including identity, memory, tools, user information, and historical records, but provides no privacy classification, minimization guidance, encryption requirement, or destination trust warning. In a migration skill, this context makes the issue more dangerous because operators are being encouraged to export a complete agent state bundle that could expose credentials, personal data, operational history, and internal configuration if mishandled.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The migration flow performs system-impacting actions such as updating configuration, creating cron tasks, and restarting the Gateway, yet the documentation does not prominently warn users about service disruption, persistence changes, or the need for confirmation/review. In this skill context, that is security-relevant because scheduled tasks and service restarts can create persistent unintended behavior or operational outages if a package is untrusted or incorrectly applied.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough that ordinary user statements like '换电脑了' or '重装系统' could activate a skill that packages and migrates highly sensitive agent state, including MEMORY.md, TOOLS.md, agent config, and cron-related data. In this context, accidental invocation is more dangerous than usual because the skill is explicitly designed to copy secrets and modify runtime configuration, so unintended activation could expose or propagate sensitive data even if later steps ask for confirmation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The payload is a broad natural-language instruction that authorizes multiple sensitive actions without constraints, such as what may be read, what may be modified, and when a commit or push is allowed. In an automated cron context, such ambiguity is dangerous because the agent may overreach, operate on the wrong files, or repeatedly propagate harmful changes without human review.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The example trigger phrase "我要搬家" is very broad and overlaps with ordinary conversation, increasing the chance that an agent could invoke packaging behavior unintentionally. In this context, the documented action leads to creating an archive of team/member data, so accidental activation could expose or export sensitive configuration without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The phrase "这是搬家包，帮我搬家" also lacks strict triggering boundaries and could be matched in natural conversation around file sharing or setup help. Because the documented behavior runs migration steps that include extraction, configuration changes, and restoration tasks, an imprecise trigger raises the risk of unintended system-modifying operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes packaging, extracting files, merging configuration, and restoring cron tasks, but does not warn users that these actions alter system state and may overwrite, import, or schedule persistent behavior. In a migration skill, absence of explicit safety warnings can cause users to approve impactful operations without understanding the scope, especially when handling archives from another environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script copies core identity and memory files, including SOUL.md, MEMORY.md, IDENTITY.md, USER.md, SKILLS.md, and memory/*.md, into a package under the user's home directory without any consent gate. In this skill context, those files are likely highly sensitive agent/persona/state data, so silent bulk packaging materially increases the risk of unintended disclosure and later exfiltration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script silently reads agent configuration and cron metadata from ~/.qclaw and incorporates them into the migration output. In an agent skill, local control-plane configuration is especially sensitive because it can reveal workspace paths, team structure, hooks, and automation schedules that enable follow-on compromise or targeted social engineering.

Ssd 3

High

• Confidence: 92% confidence
• Finding: The README explicitly instructs users to give the package to an agent so it can automatically copy identity, memory, team, skills, and cron configuration from the archive. In this context, that is dangerous because it normalizes delegating privileged import and configuration changes to an agent based on a packaged artifact, increasing the chance of unauthorized persistence, config tampering, or execution of unreviewed migration logic.

Ssd 4

Medium

• Confidence: 86% confidence
• Finding: The 'one-click move' messaging encourages users to accept an escalating chain from simple packaging to privileged actions such as merging agent configs, creating cron tasks, and restarting infrastructure. That trust-escalation pattern is risky in agent ecosystems because it lowers operator scrutiny around actions that affect persistence and execution environment integrity.

Static analysis

No suspicious patterns detected.