Openclaw Migrate

Migrate OpenClaw agents across platforms and servers, preserving identity, memory, config, and skills for deployment, backup, syncing, and upgrades.

Do not install and run this skill without reviewing and testing its scripts first. Specific recommendations: - Inspect scripts before use. export-agent.sh copies openclaw.json unchanged; sync-github.sh copies identity and memory files and will push them to whatever repo URL you provide. That can leak agent identity, long-term memory, API tokens, or PII. - If you plan to use the GitHub sync: run it against a disposable/private repo first. Check the created agent-backup contents locally before any git push. Be aware the script will try to initialize and push, and may attempt a force push if the first push fails. - The provided 'redaction' in sync-github.sh relies on jq and a simple string heuristic; do not assume it removes all secrets. Verify openclaw.json and any workspace files are sanitized manually before pushing. - The scripts assume paths like /home/node/.openclaw and tools (git, jq, openclaw CLI). Adjust paths or run inside a container that matches assumptions to avoid accidental reading of the wrong user's files. - Prefer using export-agent.sh to create a local export, review its manifest and restore.sh, and only transfer data after manual inspection and redaction. Rotate any credentials after migration and keep backups. - If you need safer behavior, modify the scripts to: (1) prompt before including MEMORY/IDENTITY files, (2) require an explicit --confirm-github flag before any network push, (3) add stricter redaction rules and fail-safe checks for jq/git availability. Confidence in this assessment is high because the repository and full scripts were available for review.

Type: OpenClaw Skill Name: openclaw-migrate-2 Version: 0.1.0 The skill bundle is designed for OpenClaw agent migration and backup, using standard shell commands and Git operations. While `scripts/export-agent.sh` copies the `openclaw.json` file (which may contain sensitive tokens) without sanitization, the `SKILL.md` explicitly warns the user to sanitize it manually. Furthermore, `scripts/sync-github.sh` demonstrates security consciousness by actively sanitizing `openclaw.json` using `jq` before pushing to a remote GitHub repository. There is no evidence of intentional data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. The observed behaviors are consistent with the stated purpose of agent management.