VPS Agent Migration

将本地 OpenClaw 子 Agent 迁移到 VPS 上运行。包括：rsync 复制文件、配置 Discord Bot、添加 bindings 路由、禁用本地账号避免冲突。使用场景：当需要将本地的 creative/dev/qa/strategist/pojun 等子 Agent 迁移到远程 VPS 时使用此...

This skill appears to perform a legitimate agent migration, but it asks you (via its instructions) to handle highly sensitive secrets and to use insecure patterns. Before using it: - Understand the sensitive files involved: ~/.openclaw/openclaw.json contains Discord bot tokens and should be treated as secret. - Avoid sshpass/plaintext passwords: prefer SSH key-based auth (disable password login on the VPS if possible). Passing passwords on the command line exposes them to shell history and process listings. - Do not paste tokens into single-line remote commands if you can avoid it; instead transfer files over an encrypted channel with correct permissions, or edit configs interactively on the VPS. - Back up both local and remote openclaw.json before modifying. Verify file ownership and permissions after copying (restrict to the service user/root). - After migration, rotate any tokens you moved (generate a new Discord bot token) to limit exposure if the transfer was observed. - The skill manifest did not declare that it needs access to config paths or secrets — treat that omission as a red flag and confirm manually what will be read/changed before running any steps. If you’re not comfortable handling tokens and root credentials directly, consider doing the migration interactively (SSH in, run commands with care) or hiring an administrator to perform the steps securely.

Type: OpenClaw Skill Name: vps-agent-migration Version: 1.0.0 The skill is classified as suspicious due to multiple severe vulnerabilities, primarily a critical Remote Code Execution (RCE) risk in `SKILL.md` (Step 3). The Python script executed on the remote VPS directly interpolates the `[Token]` placeholder into a string that is then executed, allowing for arbitrary Python code injection if a malicious token is provided. Additionally, the skill uses `sshpass` with plaintext passwords and disables `StrictHostKeyChecking`, exposing credentials and enabling potential Man-in-the-Middle attacks. Various other placeholders (`[agent名]`, `[Discord_ID]`, `[agentId]`) are directly inserted into shell commands without apparent sanitization, creating further shell injection vulnerabilities on both local and remote systems.