OpenClaw Update Checker

Check for OpenClaw updates by comparing installed version against the npm registry. Use when: user asks about updates, version status, or 'is openclaw up to...

This skill is coherent and low-risk: it only reads two global npm package.json paths and makes a single HTTPS request to the public npm registry. Before installing, note that (1) the checker will only find a globally-installed OpenClaw at the two hard-coded paths — it will not detect project-local installs; (2) the agent invoking the skill needs outbound HTTPS access to registry.npmjs.org; and (3) the script runs as the agent user, so it can only read files that user can access. If you do not want any outbound network calls, do not enable the skill or restrict network access. If you want extra assurance, you can inspect the included script (scripts/check_update.py) yourself — it is small and contains the full behavior.

Type: OpenClaw Skill Name: openclaw-update-checker Version: 1.1.1 The OpenClaw Update Checker skill is benign. Both the `SKILL.md` documentation and the `scripts/check_update.py` code consistently describe and implement a read-only operation. The skill only reads specific `package.json` files at hardcoded paths (`/usr/lib/node_modules/openclaw/package.json`, `/usr/local/lib/node_modules/openclaw/package.json`) and performs a single HTTPS GET request to the public npm registry (`https://registry.npmjs.org/openclaw`). The Python script uses only standard library functions (`pathlib`, `urllib.request`, `json`, `re`) and explicitly avoids subprocess execution, file writing, or any other system modifications. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.