Node Transfer

High-speed, memory-efficient file transfer between OpenClaw nodes using Node.js native streams and token-secured HTTP streaming without Base64 encoding.

This skill appears to do what it says (fast streaming transfers) and doesn't require external credentials, but it does run scripts on remote nodes and opens ephemeral HTTP ports. Before installing: 1) review send.js/receive.js/ensure-installed.js/deploy.js to confirm they only serve intended file paths and that tokens are cryptographically strong and single-use; 2) inspect the PowerShell output from deploy.js to ensure it doesn't modify unrelated system settings or create persistent privileged services; 3) restrict deployments to trusted nodes, enforce firewall rules (limit inbound IPs or bind to non-public interfaces if possible), and test transfers in a safe environment; 4) rotate or limit node.invoke credentials used to deploy these scripts. If you cannot audit the code, consider treating it as high-risk and avoid installing on production systems.

Type: OpenClaw Skill Name: node-transfer Version: 1.0.0 The OpenClaw AgentSkills skill bundle `node-transfer` is designed for high-speed, memory-efficient file transfer between nodes. All scripts (`send.js`, `receive.js`, `deploy.js`, `ensure-installed.js`) and documentation (`SKILL.md`, `CONTRIBUTING_PROPOSAL.md`, `INVESTIGATION_REPORT.md`, `README.md`) are clearly aligned with this stated purpose. The file transfer mechanism uses HTTP streaming with a one-time, token-based authentication and auto-shutdown, which are reasonable security measures for its function. The `deploy.js` script generates PowerShell commands to install the skill's own scripts, using Base64 encoding for reliable transport, not obfuscation of malicious payloads. There is no evidence of data exfiltration, unauthorized execution, persistence, or prompt injection attempts against the agent in any of the analyzed files.