prisma-migrate

Migrate Prisma Access configurations between different SCM tenants (TSGs). Use when moving security policies, NAT rules, address objects, and other configura...

This skill appears to implement Prisma Access tenant-to-tenant migration via the official SCM APIs and uses curl/jq — that part is coherent. However, the registry metadata's required env vars (SCM_CLIENT_ID, SCM_CLIENT_SECRET) do not match the SKILL.md and reference docs, which show separate source and destination credentials and TSG IDs (e.g., SRC_SCM_CLIENT_ID, DST_SCM_CLIENT_ID, SRC_SCM_TSG_ID, DST_SCM_TSG_ID). Before installing or running: - Review the SKILL.md and reference/migration-workflow.md fully and ensure you export the exact environment variables the scripts expect (source and target client_id/client_secret and TSG IDs). The registry metadata may be incomplete or outdated. - Use least-privileged service accounts tailored for migration; some APIs (URL/Data/AI profiles) require elevated rights — avoid using broad admin credentials unless necessary. - Test on a non-production tenant first and verify the migration flow (export → transform → import → candidate push) with limited objects. - Keep credentials scoped and rotate them after use; do not reuse long-lived high-privilege credentials. - Because this is instruction-only (runs curl against Palo Alto endpoints), confirm that your environment has curl and jq and that network egress to auth.apps.paloaltonetworks.com and api.sase.paloaltonetworks.com is allowed. - If you need clarity, contact the skill author or inspect any runtime scripts you plan to run to ensure they reference the correct env var names and do not exfiltrate data to third-party endpoints. Given the metadata/instruction mismatch, proceed with caution and correct the environment variable usage before trusting the tool in production.

Type: OpenClaw Skill Name: prisma-migrate Version: 1.1.0 The prisma-migrate skill is a legitimate administrative tool for migrating Palo Alto Networks Prisma Access configurations between tenants via the Strata Cloud Manager API. The SKILL.md and migration-workflow.md files provide detailed, technically accurate instructions for handling dependencies, stripping server-generated fields, and managing API authentication using official Palo Alto Networks endpoints (e.g., api.sase.paloaltonetworks.com). The skill includes explicit safety guardrails, such as dry-run defaults and mandatory user confirmation before committing changes, with no evidence of malicious intent or data exfiltration.