Scan Report
5 /100
tvs-cc-migrator
Claude Code 配置迁移工具 — 备份和恢复 ~/.claude/ 下的所有配置
A well-documented, legitimate Claude Code configuration backup/migration tool with proper sensitive data handling, no network exfiltration, and accurate doc-to-code alignment.
Safe to install
No action needed. The skill is safe to use.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | backup.mjs:26 — reads ~/.claude/ via readdirSync/readFileSync |
| Filesystem | WRITE | WRITE | ✓ Aligned | backup.mjs:29 — writes to user-specified output dir via copyFileSync/mkdirSync |
| Shell | WRITE | WRITE | ✓ Aligned | backup.mjs:393-397 — tar/powershell zip for local archiving only |
File Tree
3 files · 32.0 KB · 879 lines JavaScript 1f · 632L
Markdown 2f · 247L
├─
▾
scripts
│ └─
backup.mjs
JavaScript
├─
RESTORE_GUIDE.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ SKILL.md fully documents all behavior including shell usage, file operations, and sensitive field handling
✓ No network requests — all operations are purely local filesystem work
✓ Sensitive credentials (env.TOKEN, env.SECRET, etc.) are actively detected and user is offered options to clear them before backup
✓ Proper exclusion list prevents backup of runtime/session data (.session-stats.json, sessions/, history.jsonl, cache/, etc.)
✓ Restore process is human-guided (user confirms each step), not auto-executed
✓ Uses standard OS tools (tar/powershell Compress-Archive) for archiving — no custom obfuscated payloads
✓ No access to sensitive system paths like ~/.ssh, ~/.aws, or .env files outside ~/.claude/
✓ Code is clean — no eval(), atob(), base64 decode, or dynamic command construction