migrate-from-openclaw

SUSPICIOUS. The skill’s behavior is mostly coherent with a migration assistant: it reads old local state, maps it into NanoClaw, and stores credentials in plausible local destinations. The main risk is breadth: it accesses raw secrets from local files, executes many local project/service commands, and can import old skills/MCP configurations into the new environment. I see no strong sign of credential harvesting or off-platform exfiltration, so this is not malware, but it is a medium-risk skill that should only be used with careful user review of imported credentials, skills, and plugins.