Openclaw Migrate

Migrate OpenClaw configs, skills, memory, tokens, environment variables, and cron jobs to a new host via SSH with setup, test, and migrate commands.

This tool will copy your OpenClaw workspace, configuration files, environment variables (including tokens), and cron jobs to the target host and will append exported env vars to remote shell profiles. Before installing/running: - Inspect main.js yourself (it is included) and confirm the exact files/variables it will copy. The SKILL.md description of HA_* variable handling doesn’t match the code. - Backup any secrets and the remote host state. Treat the target host as trusted before transmitting secrets. - Be aware the script constructs shell/ssh/scp commands by interpolating user-supplied values (host, user, key, profile contents) without sanitization — this can be dangerous if those values contain unexpected characters. Use this only in a controlled, trusted network or with a non-privileged test account first. - Consider manually reviewing which environment variables and files you actually want migrated and remove others from your local environment or the sync list before running. - If you need assurance, run the migration in a sandbox or on a disposable VM, or ask the author for a provenance/homepage and clarification about HA_* handling and local config storage.

Type: OpenClaw Skill Name: openclaw-migrate Version: 1.0.0 The OpenClaw Migration skill is classified as suspicious due to critical shell injection vulnerabilities in `main.js`. The `sshExec` function, which executes remote commands, is vulnerable to local shell injection via user-provided `user` and `host` parameters, and remote shell injection via the `cmd` parameter. Additionally, the `syncEnvVars` function is vulnerable to remote shell injection when writing environment variables to remote shell profiles (e.g., `.bashrc`), as environment variable values are not properly sanitized, allowing for arbitrary command execution when the profile is sourced. While the skill's stated purpose of migrating OpenClaw involves high-risk operations (SSH, SCP, modifying system files), these specific implementation flaws allow for unauthorized command execution beyond the intended scope, making it a significant security risk.