← Back to Skills Marketplace
143
Downloads
0
Stars
0
Active Installs
4
Versions
Install in OpenClaw
/install any-sync
Description
Cross-device sync for OpenClaw workspace (skills, memory, settings) via GitHub
README (SKILL.md)
Any Sync
Bidirectional sync between your OpenClaw workspace and a GitHub repo.
Available Commands
/start— Setup wizard: configure sync repo, create config, run first pull/pull— Download remote changes from GitHub/push— Upload local changes to GitHub/status— Show sync status and pending changes/reset— Remove config and lockfile to start fresh
Usage Guidance
This plugin appears to do what it says (sync your OpenClaw workspace to a GitHub repo), but exercise caution before installing:
- Supply-chain risk: package.json depends on '@any-sync/cli' with a wildcard version and the docs instruct using 'npx any-sync', which can fetch and execute remote code. Prefer a pinned release or inspect the CLI package source before running.
- Automatic hooks: by default the plugin auto-pulls and auto-pushes on session start/end. Disable autoSync in the plugin config until you trust the code and repository to avoid unintended uploads.
- Review and control the target repo: only use a repository you control and ensure it's private if you don't want workspace contents exposed.
- Verify the implementation: check the linked repository (package.json points to https://github.com/imink/any-sync) and inspect the '@any-sync/cli' source for any data-exfiltration behavior before running 'npx' or installing dependencies.
If you can't review the CLI source or prefer stricter control, decline installation or ask the publisher to provide a pinned, audited release and an explicit install spec (so you know what code will be installed).
Capability Analysis
Type: OpenClaw Skill
Name: any-sync
Version: 0.2.10
The 'any-sync' skill bundle provides a legitimate utility for synchronizing an OpenClaw workspace (including skills, memory, and configuration) with a user-defined GitHub repository. It utilizes a CLI dependency (@any-sync/cli) and registers session lifecycle hooks to automate data transfers on session start and end. The instructions in the SKILL.md files are transparent, align with the stated purpose of cross-device synchronization, and require explicit user configuration and authentication (via GITHUB_TOKEN or GitHub CLI), with no evidence of malicious intent or unauthorized data access.
Capability Assessment
Purpose & Capability
Name, description, skills, hooks and code all consistently implement a GitHub-backed sync for the OpenClaw workspace (pull/push/status/start/reset). Requiring the gh CLI in hook metadata and referencing workspace paths in SKILL.md is coherent with the stated purpose.
Instruction Scope
Runtime instructions and skill docs repeatedly tell the agent to run 'npx any-sync' commands and to read/write config at $HOME/.any-sync.json and .any-sync.lock and workspace directories. That's expected for a sync tool, but running 'npx any-sync' will fetch and execute remote code if not locally installed — the instructions grant broad discretion to execute that package. Hooks auto-run autoPull/autoPush on session start/end and fail silently, which could hide failures or unexpected behavior.
Install Mechanism
No install spec is provided in the registry entry even though the package.json lists dependencies and the plugin code requires '@any-sync/cli'. The package.json uses an unpinned dependency ('@any-sync/cli': '*'), and the SKILL.md instructs use of 'npx any-sync' (runtime retrieval/execution). These are supply-chain risks: arbitrary new code could be executed when installing or running the CLI.
Credentials
The skill doesn't declare required environment variables, but the start wizard advises using GITHUB_TOKEN or gh auth login, and optionally OPENCLAW_WORKSPACE/OPENCLAW_PROFILE for custom paths. Those env vars are relevant to GitHub authentication and workspace location. No unrelated credentials or unexpected config paths are requested.
Persistence & Privilege
The plugin registers session_start and session_end hooks to auto-pull/push by default (autoSync true unless explicitly disabled). always is not set. Autonomous invocation of hooks is expected for sync behavior, but combined with the ability to push workspace contents to a configured repo, this increases the impact if the remote or CLI is malicious — consider disabling autoSync until you verify the tooling.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install any-sync - After installation, invoke the skill by name or use
/any-sync - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.10
- Updated package.json (details not shown).
- No changes to skill documentation or commands.
v0.2.9
- Updated package metadata in package.json.
- No changes to skill commands or documentation.
v0.2.8
- Update package version to 0.2.8 in package.json.
- No changes to functionality or documentation.
v0.2.7
- Add SKILL.md documentation with overview and available commands.
- Clarify features: sync skills, memory, and settings between OpenClaw and GitHub.
- List supported commands: /start, /pull, /push, /status, /reset.
Metadata
Frequently Asked Questions
What is Openclaw Plugin?
Cross-device sync for OpenClaw workspace (skills, memory, settings) via GitHub. It is an AI Agent Skill for Claude Code / OpenClaw, with 143 downloads so far.
How do I install Openclaw Plugin?
Run "/install any-sync" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Openclaw Plugin free?
Yes, Openclaw Plugin is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Openclaw Plugin support?
Openclaw Plugin is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Openclaw Plugin?
It is built and maintained by imink (@imink); the current version is v0.2.10.
More Skills