Update Scout

Automate update tracking for OpenClaw and any other GitHub-released tools. Scout monitors your watchlist weekly, reviews release notes with a security lens,...

This skill appears internally consistent with its stated role as a GitHub release watcher and reviewer. Before installing: review the packaged scripts yourself (they are included) and confirm you trust the publisher (source is unknown). Be cautious about adding watchlist entries that use detect.type=command — the exact command you store will be executed on your machine when checking versions. Only set GITHUB_TOKEN if you understand it increases API rate limits (the skill does not store the token). Don't run the skill as root; restrict its use to a non-privileged account. If you plan to let the agent invoke the skill autonomously, consider whether you trust that agent to not add malicious watchlist entries or run the review scripts without your supervision.

Type: OpenClaw Skill Name: update-scout Version: 1.1.2 The skill bundle provides legitimate software update tracking but includes high-risk capabilities that could be abused. Specifically, 'check_updates.py' and 'add_tool.py' allow for the execution of arbitrary shell commands defined in a local configuration file (~/.config/scout/watchlist.json) to detect software versions. Additionally, 'review_skills.py' performs a broad scan of all files within the OpenClaw skills workspace and fetches remote content from a hardcoded GitHub URL (openclaw/openclaw) to provide as context for the agent, creating a potential vector for indirect prompt injection. While these features align with the stated purpose of update monitoring and health checks, the lack of command sanitization and the workspace-wide file access are significant security risks.