Multi-Device Sync via GitHub

Multi-device OpenClaw data synchronization using GitHub. Manages workspace data sync across multiple machines (Ubuntu, Mac, etc.) with automatic push on file...

What to consider before installing: - Review code locally instead of running the curl | bash one-liner. Clone the repo (git clone https://github.com/RegulusZ/multi-device-sync-github.git) and inspect install.sh and the scripts before executing. - Back up your workspace first. The installer will create symlinks and may remove original files (it does back them up by default in many cases, but verify backups exist before proceeding). - Be deliberate about which paths you sync. Avoid syncing 'skills/' or other directories that may contain secrets, credentials, nested .git folders, or private configuration unless you understand the consequences. - Use a private GitHub repository as recommended. If you accidentally push sensitive data, Git history can retain it—plan for .gitignore and history cleaning if needed. - Verify authentication: the scripts rely on your existing git/SSH configuration; you will need working SSH keys or credential helpers for push/pull. - Note the installer has small bugs (calls like sync-init.sh.sh). If you see execution errors, run the scripts manually from the cloned repo and fix the call names before running automated steps. - If you want lower-risk testing, run the installer in a throwaway VM/container or test user account first to confirm behavior. If you can share the exact repo URL or want, I can point out the exact lines that (1) delete files, (2) start daemons, and (3) would commit which paths so you can audit them quickly.

Type: OpenClaw Skill Name: multi-device-sync-github Version: 1.0.2 The skill is designed for multi-device data synchronization using GitHub, performing high-privilege operations like installing system packages, creating symlinks in the OpenClaw workspace, and running background daemons. While it includes several explicit safety features (e.g., local-only notifications, backups, confirmation prompts, selective git operations) and warns users about security, the 'Quick Install' method in SKILL.md and README.md uses `curl -fsSL ... | bash`. This pattern, although common, represents a significant supply chain vulnerability as it executes remote code directly without prior review, posing a remote code execution risk if the remote script or its hosting repository were compromised. Additionally, there are minor bugs like `sync-init.sh.sh` and `sync-daemon.sh.sh` typos in `install.sh` that would prevent proper execution. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, credential theft, or stealthy backdoors.