Skills Updater

Automatically detect, backup, and update OpenClaw skills using caching, retry logic, dry-run mode, and detailed upgrade reports.

This updater appears to be internally consistent with its purpose, but review a few things before enabling automatic updates: 1) Run in --dry-run and/or --cache-only first to see what would change. 2) Inspect the included script (scripts/check-skill-updates.py) yourself to confirm behavior you’re comfortable with—it will copy entire skill directories to ~/Desktop/skill-backups. Backups can therefore include any secrets stored inside skills, so ensure you’re OK with that destination/permissions. 3) Verify the ClawHub base URL (script uses https://clawhub.ai) and that you trust that registry; network downloads happen when --auto is used. 4) There are multiple minor inconsistencies in metadata and docs (version numbers differ between SKILL.md, README.md, and _meta.json; README support URL differs from the script’s API host; some performance/metric claims appear exaggerated). These look like sloppy packaging rather than malicious intent but justify caution. 5) Keep automatic mode off until you’ve confirmed behavior locally; prefer dry-run and manual restore testing first.

Type: OpenClaw Skill Name: skills-updater Version: 1.1.0 The 'skills-updater' bundle is a legitimate utility designed to manage OpenClaw skill versions. The core logic in `scripts/check-skill-updates.py` implements version detection, automated backups to the user's Desktop, and secure updates via the official ClawHub API (clawhub.ai). The script includes several security best practices, such as SSL certificate verification, owner-only cache permissions (0700), and explicit path traversal protection during ZIP extraction to prevent arbitrary file writes. No evidence of data exfiltration, obfuscation, or malicious intent was found.