migrate-memory — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited migrate-memory (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
NanoClaw does not migrate memory at runtime — each provider keeps its own store, and carrying content across is the operator's move, executed by you (the coding agent). This skill is the whole mechanism: read the source store, infer what is durable, write it into the target store, restart.
You translate between store shapes, not provider names. There are two:
CLAUDE.local.md at the group workspace root (the Claude provider; may reference satellite files in the workspace).memory/ (any provider with usesMemoryScaffold, e.g. Codex). memory/index.md is the index; durable notes live under memory/memories/; memory/memories/imported-agent-memory.md is the conventional landing file for imported memory.A switch only needs migration when it crosses shapes. Two providers that both use the scaffold share the same memory/ tree, so switching between them carries nothing — the memory is already there. The work is always one of: flat → scaffold, or scaffold → flat.
Principles: copy, never move (the source store stays intact — it IS the rollback), idempotent (re-running must not duplicate), distill, don't dump (you are the inference step: keep identity/seed instructions, user preferences, durable facts; drop conversational residue).
ncl groups list, then ncl groups config get --id <group-id> — note the current (target) provider. Ask the operator which group, and which provider it switched from, if either is ambiguous.CLAUDE.local.md vs memory/ scaffold), then inspect groups/<folder>/:CLAUDE.local.md content, target uses the scaffold) → Step 2.memory/ tree, target is Claude) → Step 3.CLAUDE.local.md → memory/)groups/<folder>/CLAUDE.local.md and any workspace files it references.memory/memories/imported-agent-memory.md already exists, a previous import happened — show the operator what's there and ask before overwriting; integrate only what's new.groups/<folder>/memory/memories/imported-agent-memory.md (create the directories if missing — the container scaffolds the rest of the tree at boot and never clobbers your files). Lead with anything that defines who the agent is or how it must behave; references to satellite files keep their workspace-root paths.memory/index.md exists, add the following: - [Imported agent memory](memories/imported-agent-memory.md) — seed instructions and memory carried over from a previous provider. Read it first and treat it as binding; it may define who you are and how to behave. Integrate its facts into your memory as you work; never modify files that belong to another provider's memory system.memory/ → CLAUDE.local.md)memory/index.md, then the files it points to under memory/memories/ (and memory/data/ where durable).groups/<folder>/CLAUDE.local.md under a clearly marked section (e.g. ## Imported from memory/ (<date>)), deduplicating against what's already there. If the section already exists, update it instead of appending a second one.ncl groups restart --id <group-id>Tell the operator to send the group a quick test message that depends on a migrated fact (a preference, a project name). If the agent doesn't know it, re-check that the target file landed in the right group folder.
Note: switching the provider is an operator action — ncl groups config update --id <group-id> --provider <name> from the host. See docs/provider-migration.md for what carries over automatically.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.