安装指南

1. ClawHub CLI 从源直接安装技能的最快方式。
   npx clawhub@latest install password-manager-migrator
2. 手动安装 将技能文件夹复制到以下位置之一
   全局模式
   ~/.openclaw/skills/
   工作区
   /skills/
   优先级：工作区 > 本地 > 内置
3. 提示词安装 将此提示词复制到 OpenClaw 即可自动安装。
   请帮我使用 Clawhub 安装 password-manager-migrator。如果尚未安装 Clawhub，请先安装（npm i -g clawhub）。
   更倾向于下载？
   获取包含原生技能文件的ZIP压缩包。
   下载技能 (.zip)

什么是

Password Manager Migrator 可帮助你在 Bitwarden、1Password、KeePass、Chrome 或 Safari 与 Proton Pass 保险库之间切换或合并，减少意外情况。它会识别推荐的迁移路线、说明可能丢失的内容、生成字段映射指南、盘点 TOTP 重新注册风险，并支持迁移后审计。
与处理保险库内容的工具不同，此技能依据你提供的格式、数量和元数据运行。它使用 Python 3 和标准库离线运行，是注重安全的保险库迁移过程中，Openclaw Skills 的实用补充。

应用场景

在受支持的密码管理器之间切换，并选择原生、JSON 或 CSV 迁移路线。
合并个人、继承、伴侣或工作保险库，同时规划重复项处理方式。
在停用旧保险库前，检查哪些 TOTP 条目需要逐个网站重新注册。
审计迁移前后的项目数量、重复项总数和弱项标记。
准备字段映射工作表，并跟踪需要人工处理的附件或账户共享项目。

工作原理

规划路线：指定源管理器和目标管理器，以及此次迁移是否为合并。查看建议的导入路径、传输限制、检查点和回滚指南。
映射字段并处理冲突：生成 CSV 工作表并应用规定的重复项优先规则：通常以修改日期较新的项目为准；冲突项会标记为需要人工审核，而不会被静默合并。
盘点 TOTP 风险：识别可能无法保留 TOTP 数据的迁移路径，并在删除或停用源保险库前创建重新注册清单。
在密码管理器中执行迁移：按照计划使用管理器自带的导出和导入工具；此技能不会处理或检查机密值。
审计结果：提供迁移前后的数量、重复项总数和弱项标记，以获取验证结论和剩余风险清单。
安全完成切换：验证有代表性的登录项和附件，安全删除明文导出文件，并将旧保险库保持为只读状态 30 天。

配置指南

此技能需要 Python 3，且仅使用标准库。它离线运行，不需要网络访问、凭据或机密值。在可用 scripts/vault_migrate.py 的技能目录中运行命令；未指定需要单独安装任何软件包。

规划从 Bitwarden 迁移到 1Password

python3 scripts/vault_migrate.py plan --from bitwarden --to 1password

规划 Bitwarden 保险库合并

python3 scripts/vault_migrate.py plan --from bitwarden --to bitwarden --merge

检查基于 CSV 的迁移中的 TOTP 风险

python3 scripts/vault_migrate.py totp --via csv

生成从 KeePass 到 Bitwarden 的字段映射工作表

python3 scripts/vault_migrate.py worksheet --from keepass --to bitwarden

审计迁移数量和剩余标记

python3 scripts/vault_migrate.py audit --pre-logins 412 --post-logins 398 \ --pre-notes 55 --post-notes 55 --pre-cards 9 --post-cards 9 \ --duplicates 41 --weak-left 23 切勿将密码、TOTP 种子或其他有效机密粘贴到工作流程中。不要将任何明文导出文件放在云同步文件夹中，并在验证迁移后安全删除。

数据架构

此工作流程基于元数据：它接受管理器名称、迁移选项、项目数量、重复项数量和弱项数量。它不会读取或存储实际保险库机密。
工件或输入 用途
路线计划 推荐的迁移路径、预期传输和丢失内容、按顺序排列的步骤、检查点及回滚指南。
字段映射工作表 用于将源字段映射到目标字段的 CSV 模板。
TOTP 清单和重新注册列表 跟踪可能无法迁移的条目，以及需要重新注册 2FA 的网站。
审计输入 按项目类型统计的迁移前后数量，以及重复项和弱项总数。
审计结果 验证结论和需要调查的剩余风险列表。
参考文件 references/route-matrix.md 涵盖路线详情和导入器特性；references/audit-worksheet.md 涵盖去重规则、冲突处理、TOTP 重新注册和切换指南。
编码后的路线指南考虑了特定格式之间的差异：例如，Chrome CSV 仅保留 URL、用户名和密码；而其他路线可能保留更多字段，但仍可能丢失附件、文件夹结构、标签、图标、历史记录或其他元数据。

高级特性

比较受支持管理器之间的迁移路线，包括在适用时优先建议原生导入，并提醒 JSON 或 CSV 的取舍。
使用修改日期优先规则规划合并，并明确要求人工审核冲突；指南还会提醒，CSV 导出日期可能会影响修改日期比较。
盘点 TOTP 风险，突出显示在移除旧保险库前需要重新注册的账户。
按数量审计迁移后的登录项、备注、卡片、重复项和剩余弱项。
运行安全措施，包括将旧保险库保持为只读状态 30 天、检查附件数量，以及在导入后测试真实登录。
仅使用标准库的 Python 离线运行，不进行网络调用，也无需提供机密值；此技能不提供 hooks 或多智能体功能。

name: password-manager-migrator description: Use when moving between password managers (Bitwarden/1Password/Keepass/Apple/Chrome/Proton), merging vaults, or auditing one — builds a safe migration plan (export format matrix, dedupe/merge precedence rules, TOTP and attachment traps, 2FA-site re-enrollment list), generates the field-mapping worksheet, and runs a post-migration audit for duplicates, weak leftovers, and reused entries. Never touches actual secrets — works from counts and metadata you paste. version: 1.0.0
author: Denis Voronin
license: MIT
tags: [passwords, password-manager, migration, bitwarden, 1password, keepass, security]

Password Manager Migrator

Migrating password managers is one of the highest-stakes household data moves: do it wrong and you lose TOTP seeds, attachments, and folder structure — or silently drop accounts you won't notice for a year. The export formats don't map 1:1 (Bitwarden JSON has folders + TOTP; KeePass has groups + icons + history; Chrome CSV loses both), and every path has specific traps.

This skill builds the migration plan, never touching your secrets: it works from metadata (counts, formats) and produces checklists, worksheets, and the audit logic.

When to Use

Switching managers (any direction among Bitwarden, 1Password, KeePass, Chrome/Safari, Proton Pass)
Merging two vaults (personal + inherited, couple merge, work split)
Post-migration audit: what didn't survive the import
Deciding WHICH route: direct import vs CSV vs JSON

Don't use for: live secret values — nothing here ever needs your actual passwords. If a tool asks for them outside the manager itself, stop.

The Method

plan — from → to: the best route (native import > JSON > CSV), what transfers and what's LOST per hop, ordered steps with checkpoints, rollback point (keep the old vault read-only for 30 days).
worksheet — the field-mapping CSV template + precedence rules for duplicates (newer modified-date wins; conflicts flagged for manual review, never auto-merged silently).
totp — TOTP inventory + re-enrollment list: which sites' 2FA won't survive and must be re-enrolled BEFORE deleting anything.
audit — paste counts (pre/post item counts per type, duplicates found, weak flags) → verification verdict + residual-risk list.

Quick Start

# Bitwarden -> 1Password
python3 scripts/vault_migrate.py plan --from bitwarden --to 1password

# Merge two Bitwarden vaults (couple merge)
python3 scripts/vault_migrate.py plan --from bitwarden --to bitwarden --merge

# The TOTP trap list for Chrome CSV hop
python3 scripts/vault_migrate.py totp --via csv

# Post-migration numbers check
python3 scripts/vault_migrate.py audit --pre-logins 412 --post-logins 398 \

--pre-notes 55 --post-notes 55 --pre-cards 9 --post-cards 9
--duplicates 41 --weak-left 23

# Field mapping worksheet (CSV) for the hop
python3 scripts/vault_migrate.py worksheet --from keepass --to bitwarden

Stdlib-only Python 3. Offline. Zero network. Zero secrets.

Route Matrix (what the script encodes)
From → To Best route Survives LOST
Bitwarden → 1Password 1P native Bitwarden importer logins, notes, cards, TOTP folders→tags (approx), attachments (manual) 1Password → Bitwarden BW native 1P importer (or 1PIUX→enc JSON) logins, notes, TOTP tags, attachments, document count check KeePass → Bitwarden BW native KP importer logins, notes, TOTP (otp field), groups→folders icons, entry history, auto-type
Any → Chrome CSV only URL/user/pass TOTP, folders, notes attachments, card CVV
Chrome → Bitwarden BW native Chrome importer logins passwords saved after last export
Proton ↔ Bitwarden Proton importer / BW importer logins, notes Proton aliases need email-forward check
The Traps (ranked by pain)
TOTP seeds are one-shot. Exported seeds that fail to import are RECOVERABLE ONLY by re-enrolling each site (needs password + working 2FA). Inventory BEFORE deleting the old vault.
Chrome CSV drops TOTP + everything but URL/user/pass — fine as an intermediate, fatal as "the migration."
Attachments don't ride exports. Count them; they move manually or get re-added as secure notes/attachments.
Modified-date lies after CSV hops (export date replaces it) — breaks "newer wins" dedupe. Prefer JSON/native routes when merging.
Duplicate storm after merge. Import everything, dedupe INSIDE the target, never pre-dedupe two half-copies.
Old vault deleted too early. Keep read-only 30 days; the login you need in week 3 WILL be the one that didn't import.

Common Pitfalls

Doing the export on a machine you're about to wipe. Export + import
audit on stable hardware, then wipe.
Unencrypted JSON export left in Downloads. The export contains EVERYTHING in plaintext. Secure-delete it after verified import; never let it touch cloud sync folders.
Trusting the importer's success message. Count-based audit (pre vs post per type) is the only real verification.
Merging and migrating in one step. Two operations, two audits.
Ignoring password-based (not link-based) sharing entries — shared items need re-sharing from the new vault, they don't migrate.

Verification Checklist

Export created (count items per type first — that's your pre-count)

Import done into the TARGET with 2FA on the account already
audit run with pre/post counts — deltas explained
TOTP re-enrollment list worked through (each site: old code still valid → enroll new → verify → note it)

Attachments count matches

Plaintext export secure-deleted

Old vault kept read-only 30 days, calendar reminder set
One real login test per category (bank, email, shopping)

References

references/route-matrix.md — full per-hop details, per-manager export menu paths, importer quirks, encrypted-export options
references/audit-worksheet.md — the dedupe precedence rules, TOTP re-enrollment protocol, merge conflict workflow, 30-day cutover plan
铲雪策略师

Houseplant Watering Computer