tvs-cc-migrator

Claude Code 配置迁移工具。备份和恢复 ~/.claude/ 下的所有配置（CLAUDE.md、rules、skills、commands、agents、自定义插件、settings.json 等）。当用户提到备份配置、迁移 Claude Code、导出设置、恢复配置、换电脑等场景时使用此 skill。

This skill appears to do what it claims, but review and act cautiously: - The backup script reads ~/.claude/ and will detect settings.json tokens/keys. If you choose to keep sensitive values in the backup, the resulting archive will contain secrets that could be abused if leaked. Prefer the option that clears sensitive fields unless you accept the risk. - The manifest includes source_machine and source_user (hostname and username); be aware this exposes identifying metadata in the backup. - The included script imports child_process.execSync (likely for zipping or platform commands). Before running, skim scripts/backup.mjs to confirm no unexpected commands are executed automatically; the SKILL.md indicates the script only scans and packages locally, but verify the implementation if you have security concerns. - Keep backup archives encrypted and transfer them via trusted channels. When restoring on a new machine, verify the manifest and contents before applying or executing any reinstall commands listed in the package. If you want higher assurance, run the script on a disposable machine or inspect it line-by-line to confirm it does only local file operations and zipping.

Type: OpenClaw Skill Name: tvs-cc-migrator Version: 1.0.0 This skill is a migration tool designed to backup and restore Claude Code configurations from the sensitive `~/.claude/` directory, which contains authentication tokens and environment variables. While the script `scripts/backup.mjs` includes logic to detect and redact sensitive fields, it performs broad file system operations and uses `execSync` to invoke system shell commands (`tar` and `powershell`) for archiving. Additionally, the restoration process described in `RESTORE_GUIDE.md` instructs the agent to execute commands derived from configuration files, which could lead to arbitrary command execution if the backup data is tampered with. The inherent risk of automating credential collection and the use of shell-based archiving warrants a suspicious classification.