Claude Sync Kit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Sync Kit (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
Cross-device sync for your Claude Code setup. A wizard skill that walks you through creating a private GitHub repo that mirrors your ~/.claude/ configuration across machines — settings, custom skills, plugin/MCP enablement — without ever committing your auth token.
Distributed as a Claude Code plugin via its own marketplace.
A single-skill Claude Code plugin. After you install it, ask Claude something like:
The cross-device-sync skill activates and walks you through:
inventory) and what stays per-device (auth tokens, sessions, memory, plans, runtime state).
gh repo create --private..gitignore, bootstrap, prereqs,push-from-machine, plus a per-MCP re-auth guide.
git ls-files check forcredentials, .env, OAuth, Python build artifacts.
prereqs → login → bootstrap →restart → re-authenticate connectors on first use.
The repo it creates is yours. This plugin doesn't host anything centrally and doesn't phone home.
/plugin marketplace add Fluory/claude-sync-kit
/plugin install claude-sync-kitThen start a conversation and ask Claude to sync your setup.
| File / Folder | Synced? | Why |
|---|---|---|
~/.claude/settings.json | YES | Master config with enabled plugins |
~/.agents/skills/ (or wherever your skill content lives) | YES | The actual skill files |
Plugin contents (~/.claude/plugins/cache/) | NO | Regenerates from marketplace on first start |
| MCP/connector list | YES (implicit) | Comes via enabled plugins in settings.json |
| MCP/connector auth tokens | NO | Each machine re-auths (security feature) |
.credentials.json | NEVER | Your Claude auth token |
~/.claude.json | NO | Runtime state, OAuth, growthbook |
projects/, sessions/, tasks/, todos/ | NO | Per-device session state |
plans/, shell-snapshots/, cache/ | NO | Local state |
The bundled .gitignore covers all of this.
A static template repo would force you into one structure. The wizard:
best-effort).
symlinks on Unix often resolve to a separate skills directory).
You can also just lift the templates from skills/cross-device-sync/templates/ and use them directly without Claude in the loop.
claude-mem per-project memory is intentionallyout of scope. It's per-project, per-device, conflict-prone.
setup; it doesn't help you redistribute downloaded third-party skills.
mirror, not a vault.
templates are reasonable but unverified. PRs welcome.
key on one laptop should not appear on another via a sync. If this annoys you, you're using the wrong tool.
private repos and invalidate them. The .gitignore matters even when the repo is private. The skill enforces a pre-push check.
MIT. See LICENSE.
@Fluory — Florian Hein.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.