OpenClaw Migrator

Securely migrate OpenClaw Agent (config, memory, skills) to a new machine.

This skill appears to implement what it claims, but review before running: 1) Source metadata lacks a homepage — prefer to install from a known/trusted repository or release tag. 2) The tool will read your HOME/.openclaw and HOME/clawd by default and will include sensitive files (openclaw.json, any tokens) in the encrypted archive — verify what is being packaged or exclude files you don't want migrated. 3) The code uses a password (CLI --password or MIGRATOR_PASSWORD env var) but the registry didn't declare required env vars — be explicit when running (pass a strong password via --password). 4) There are developer/test CLI drivers in archive.js and restore.js that operate on test-data; they require MIGRATOR_PASSWORD and are harmless if not executed, but avoid running unknown scripts directly. 5) Always verify the archive on the target machine before restoring and keep a backup of the current target data. If you want higher assurance, ask the publisher for an official release URL, checksum-signed artifacts, or run the tool in an isolated environment first.

Type: OpenClaw Skill Name: openclaw-migrator Version: 1.0.0 The OpenClaw Migrator skill bundle is designed to securely export and import OpenClaw agent data (config, memory, skills) between machines. It uses AES-256-GCM encryption for confidentiality and integrity, and handles sensitive data like `openclaw.json` by encrypting it into a local archive. All file system operations and environment variable access (e.g., `process.env.HOME`, `process.env.MIGRATOR_PASSWORD`) are directly aligned with its stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` or `README.md`. The `package.json` even includes a `scan` script to detect API keys, indicating a security-conscious approach.