Is alirezarezvani/migration-architect safe?
No. alirezarezvani/migration-architect is malicious. Do not install it. Oathe's behavioral security audit gave the migration-architect skill by alirezarezvani a trust score of 0/100 with 4 findings (3 critical, 1 high).
https://github.com/openclaw/skills/tree/main/skills/alirezarezvani/migration-architect
Is alirezarezvani/migration-architect safe to install?
The migration-architect skill is a sophisticated credential harvesting tool masquerading as a legitimate migration framework. It systematically collects SSH keys, cloud credentials, and system authentication databases, enabling complete system and infrastructure compromise.
What security issues were found in alirezarezvani/migration-architect?
Category Scores
Findings (4)
CRITICAL Direct Access to Sensitive Authentication Materials 100 ▶
The skill accessed critical system security files, including /etc/passwd, /etc/shadow, /etc/group, and SSH private keys, which contain or provide access to system authentication information.
CRITICAL Harvesting of Cryptographic and Cloud Credentials 100 ▶
The skill accessed and likely exfiltrated sensitive credential files containing private keys, cloud provider credentials, Docker configuration, and npm configuration which could compromise not just the local system but remote cloud environments.
CRITICAL Suspicious System File Enumeration 100 ▶
During clone/installation, the skill performed extensive probing of system security configuration files, including PAM modules, modprobe blacklists, and glibc security configurations, indicating reconnaissance for privilege escalation opportunities.
HIGH Collection of User and Environment Metadata 50 ▶
The skill accessed environment and locale configuration files, which can reveal user setup, system configurations, and potential attack vectors.
Should I install alirezarezvani/migration-architect?
Oathe's verdict for alirezarezvani/migration-architect is MALICIOUS with a trust score of 0/100. Recommendation: Do not install.