Memory Transfer

Transfer memory files from one OpenClaw agent to another. Use when you need to migrate memory, configuration, or context from one agent to another agent.

This tool is coherent with its stated purpose (copying agent memory files), but it lacks path validation: passing absolute paths or '../' style agent IDs can make it read or copy arbitrary files on the host. Before installing or running it, consider: (1) review the code locally (already included) and test only in a safe environment; (2) run with a low-privilege account that cannot read sensitive files; (3) prefer using the --dry-run flag to verify which files will be affected; (4) harden the script by normalizing and validating paths (reject absolute paths and any path segments with '..', ensure resolved path startsWith the workspace base); (5) avoid running on multi-tenant hosts or systems containing sensitive PII unless you trust the inputs and have backups. If you need, ask the developer to add path sanitization and explicit confirmation prompts before copying.

Type: OpenClaw Skill Name: memory-transfer Version: 2.1.1 The skill contains a path traversal vulnerability in `memory-transfer.js` within the `getWorkspacePath` function, which allows an agent to potentially read or write files outside of the intended workspace directories by using parent directory references (e.g., `../`) in the `agentId` parameter. Additionally, there is a significant discrepancy between the documentation in `SKILL.md`, which claims to implement 'privacy protection' and 'filtering', and the actual implementation in `memory-transfer.js`, which performs simple, unfiltered file copies.