Migrate

Export and import Clawdbot installations for migration between machines. Use when the user wants to migrate Clawdbot to a new computer, backup their setup, or restore from a backup. Handles workspace files, config, WhatsApp sessions, and optionally credentials.

This skill appears to implement a legitimate Clawdbot migration (it archives/restores workspace and ~/.clawdbot), but be cautious before using it: - Metadata mismatch: the package metadata claims no config paths or env vars, but the scripts read/write $HOME/.clawdbot and respect CLAWDBOT_WORKSPACE. Treat that as a red flag about accuracy of the listing. - Sensitive data: the export can include WhatsApp sessions and stored credentials. Only create/transfer such archives over trusted, encrypted channels and avoid including credentials unless absolutely necessary. - Inspect archives before restoring: an imported archive may contain code or scripts inside the workspace that could run later (for example when you start Clawdbot). Extract and inspect the archive contents before copying into your live workspace. - Backup first: keep a backup of your current workspace/config before running import, especially if using --force. - Least privilege: run export/import as your normal user (not root) and avoid restoring third-party archives to privileged locations. - Integrity & provenance: get the archive from a trusted source; consider checksums or signatures when transferring between machines. - Additional note: the scripts conditionally use jq to edit config; jq is optional but if present will be used. If you want stricter behavior, inspect the scripts and run them manually. Given the mismatches and the ability to move highly sensitive data, review the scripts and confirm the archive source before proceeding.

Type: OpenClaw Skill Name: migrate Version: 1.0.0 The skill is designed for migrating Clawdbot installations, which includes handling sensitive configuration and data. It is classified as suspicious due to the explicit capability to export and import credentials via the `--include-credentials` flag, as documented in `SKILL.md` and implemented in `scripts/export.sh` and `scripts/import.sh`. While this feature is opt-in and includes a warning, the direct handling of credentials represents a high-risk capability that could lead to accidental exposure or misuse, even without clear evidence of intentional malicious exfiltration to external endpoints.