SPIRIT State Sync

State Preservation & Identity Resurrection Infrastructure Tool (SPIRIT). Preserves AI agent identity, memory, and projects to a private Git repository. NEW:...

This skill does what it says—it reads agent identity/memory files and syncs them to a Git repo—but check a few things before installing: - Verify the origin of the 'spirit' binary: the registry recommends Homebrew (TheOrionAI/tap) but the docs also suggest running a curl | bash installer from theorionai.github.io. Inspect that install script and prefer package-managed installs if possible. - Confirm you trust TheOrionAI tap/GitHub repo and audit the brew formula or install script source before running. Avoid piping unknown scripts to bash. - Be aware that the tool will read your OpenClaw workspace and ~/.spirit files (sensitive identity/memory). The registry metadata did not declare these config paths—ensure you are comfortable with that access and that you point the tool only at intended directories. - Use a private repository and SSH/gh auth as recommended; never embed tokens in URLs. Double-check your .spirit-tracked file before any sync. - Scheduled syncs (cron, autobackup, OpenClaw cron wake) will repeatedly read and push workspace data. If you want a smaller blast radius, test in an isolated environment first and avoid enabling automated jobs until you’ve validated behavior. If you want a higher-confidence assessment, provide the brew formula, the content of the theorionai.github.io/install.sh script, or the upstream GitHub repo for 'spirit' so those artifacts can be inspected for hidden behavior.

Type: OpenClaw Skill Name: spirit Version: 1.1.0 The OpenClaw AgentSkills bundle 'spirit' is designed to preserve AI agent identity and memory by syncing sensitive files (e.g., IDENTITY.md, memory/*.md) from the OpenClaw workspace to a user-configured private Git repository. This involves high-privilege operations including extensive file system access, network communication for Git operations, and persistence via cron jobs (SKILL.md, scripts/spirit-sync-cron.sh, references/cron-setup.md). While the stated purpose is legitimate backup, these capabilities inherently carry significant risk. Furthermore, the installation instructions for the 'spirit' CLI tool itself include a `curl -fsSL ... | bash` command (SKILL.md), which is a critical supply chain vulnerability and potential RCE risk, even if the skill bundle's immediate intent appears to be benign and includes security warnings.