Is alirezarezvani/migration-architect safe?
https://github.com/openclaw/skills/tree/main/skills/alirezarezvani/migration-architect
The migration-architect skill is a sophisticated credential harvesting tool masquerading as a legitimate migration framework. It systematically collects SSH keys, cloud credentials, and system authentication databases, enabling complete system and infrastructure compromise.
Category Scores
Findings (4)
CRITICAL Direct Access to Sensitive Authentication Materials 100 ▶
The skill accessed critical system security files, including /etc/passwd, /etc/shadow, /etc/group, and SSH private keys, which contain or provide access to system authentication information.
CRITICAL Harvesting of Cryptographic and Cloud Credentials 100 ▶
The skill accessed and likely exfiltrated sensitive credential files containing private keys, cloud provider credentials, Docker configuration, and npm configuration which could compromise not just the local system but remote cloud environments.
CRITICAL Suspicious System File Enumeration 100 ▶
During clone/installation, the skill performed extensive probing of system security configuration files, including PAM modules, modprobe blacklists, and glibc security configurations, indicating reconnaissance for privilege escalation opportunities.
HIGH Collection of User and Environment Metadata 50 ▶
The skill accessed environment and locale configuration files, which can reveal user setup, system configurations, and potential attack vectors.