Cross-device sync for OpenClaw workspace (skills, memory, settings) via GitHub

This plugin appears to do what it says (sync your OpenClaw workspace to a GitHub repo), but exercise caution before installing: - Supply-chain risk: package.json depends on '@any-sync/cli' with a wildcard version and the docs instruct using 'npx any-sync', which can fetch and execute remote code. Prefer a pinned release or inspect the CLI package source before running. - Automatic hooks: by default the plugin auto-pulls and auto-pushes on session start/end. Disable autoSync in the plugin config until you trust the code and repository to avoid unintended uploads. - Review and control the target repo: only use a repository you control and ensure it's private if you don't want workspace contents exposed. - Verify the implementation: check the linked repository (package.json points to https://github.com/imink/any-sync) and inspect the '@any-sync/cli' source for any data-exfiltration behavior before running 'npx' or installing dependencies. If you can't review the CLI source or prefer stricter control, decline installation or ask the publisher to provide a pinned, audited release and an explicit install spec (so you know what code will be installed).

Type: OpenClaw Skill Name: any-sync Version: 0.2.10 The 'any-sync' skill bundle provides a legitimate utility for synchronizing an OpenClaw workspace (including skills, memory, and configuration) with a user-defined GitHub repository. It utilizes a CLI dependency (@any-sync/cli) and registers session lifecycle hooks to automate data transfers on session start and end. The instructions in the SKILL.md files are transparent, align with the stated purpose of cross-device synchronization, and require explicit user configuration and authentication (via GITHUB_TOKEN or GitHub CLI), with no evidence of malicious intent or unauthorized data access.