技能详情（站内镜像，无评论）
作者：Hongyu Li @blueraincoatli
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.1.3
统计：⭐ 0 · 29 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：blueraincoatli/persona-sync
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's behavior mostly matches its stated purpose (syncing persona via a GitHub private repo) but has several surprising or underdeclared side effects (global git config changes, global plaintext credential storage) and a mismatch between metadata and actual dependencies.
目的
The skill claims to be an instruction-only persona sync helper, which fits the included sync.py, but the registry metadata lists no required binaries/envs while the code clearly depends on git and python3 (and optionally reads PERSONA_STORE_DIR). The missing declared dependencies is an incoherence a user should know about.
说明范围
SKILL.md and SPEC.md describe local-only behavior and claim the token is never embedded in configs or logs. The script does read a local .gitauth, perform local git operations (init/fetch/pull/push), and write local files (memory.jsonl, state.json, sync.log). However the script also changes the user's global git credential helper (git config --global credential.helper store) and relies on git's credential store (~/.git-credentials), which is a…
安装机制
No remote install or downloaded code is executed; this is an instruction/script bundle (no install spec). The code is local and uses subprocess calls to git — low installation risk, but runtime side-effects still matter.
证书
The skill requests no env vars in registry metadata, yet the script supports PERSONA_STORE_DIR and requires git to function and expects a GitHub PAT in a local .gitauth file. It will cause the PAT to be stored by git's credential helper in ~/.git-credentials (global), which the SKILL.md asserts will be mode 0600 but the script does not enforce or set file permissions for that file. Asking users to place a PAT in a local file and then changing …
持久
The skill does not run automatically and always:false is correct, but it modifies global git configuration (credential.helper = store) which persists beyond the persona-store and affects all git operations on the host. This persistent side-effect is not clearly called out in the metadata and increases blast radius for credential exposure.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Persona Sync」。简介：在多个设备间通过 GitHub 私有仓库同步 AI 伙伴人格文件，确保记忆与个性不丢失。。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/blueraincoatli/persona-sync/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。