← Back to Skills Marketplace
104
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install xiaopi-auto-updater
Description
Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w...
Usage Guidance
What to check before installing:
- Verify publisher & metadata: the skill bundle lacks a homepage/source and the included _meta.json ownerId/slug differs from the registry metadata — confirm you trust the account that published this skill.
- Review the script before enabling: the helper script (~/.clawdbot/scripts/auto-update.sh) is created and will run package manager and clawdhub commands. Open and read it to ensure it does nothing unexpected.
- Run a dry-run first: use `clawdhub update --all --dry-run` and test the commands manually before enabling cron to see what would change.
- Limit privilege & scope: run the cron under an isolated user/session (the skill already suggests --session isolated) and avoid running global package managers as root unless you understand the implications.
- Backup & logging: ensure backups exist and retain the update log (~/.clawdbot/logs/auto-update.log) so you can inspect changes and recover if an update introduces issues.
- Consider restricting updates to trusted skills: automatic updates can introduce new code; if you rely on sensitive skills, prefer manual review or whitelist-only updates.
Why I flagged this as suspicious rather than benign: the runtime behavior is coherent with the described purpose, but missing source/homepage and inconsistent metadata raise provenance concerns — those should be resolved before you allow automatic updates to run.
Capability Analysis
Type: OpenClaw Skill
Name: xiaopi-auto-updater
Version: 1.0.0
The 'xiaopi-auto-updater' skill is a legitimate utility designed to automate updates for the Clawdbot platform and its installed skills. It uses standard package managers (npm, pnpm, bun) and internal CLI tools (clawdbot, clawdhub) to perform updates and schedules them using the system's built-in cron functionality. The implementation in SKILL.md and references/agent-guide.md is transparent, follows the stated purpose, and includes no evidence of data exfiltration, unauthorized access, or malicious prompt injection.
Capability Assessment
Purpose & Capability
The declared purpose (daily auto-update of Clawdbot and installed skills) matches the runtime instructions: add a cron job, run clawdbot update/doctor, and run clawdhub update --all. Required permissions (writing under ~/.clawdbot, running package managers, possibly elevated privileges for global npm/pnpm installs) are consistent with the task. However the registry metadata (_meta.json ownerId/slug) does not match the registry metadata provided, and the package has no homepage or source URL — this discrepancy is unexpected and worth verifying with the publisher.
Instruction Scope
SKILL.md and references instruct the agent to examine installation type (checking ~/.clawdbot, /opt), create a script at ~/.clawdbot/scripts/auto-update.sh, log to ~/.clawdbot/logs/, and run global package manager commands and clawdhub. All of these actions are within scope for an updater. The instructions do not reference unrelated system paths, external upload endpoints, or extra environment variables. Still, the script will execute arbitrary package updates (npm/pnpm/bun) which can change code and behavior — so reviewing the exact commands and the registries they pull from is important.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to install from remote URLs, which minimizes supply-chain risk from the skill bundle itself. The updater relies on existing system tools (clawdbot, clawdhub, npm/pnpm/bun) rather than downloading code from arbitrary URLs.
Credentials
The skill declares no required environment variables, credentials, or config paths. The runtime instructions use $HOME and check local paths (e.g., ~/.clawdbot) which is proportional to an updater. There is no request for unrelated secrets or external tokens.
Persistence & Privilege
The skill recommends adding a cron job (persistence appropriate for periodic updates). It does not set always:true and does not demand permanent elevated privileges in its manifest. However, the cron job will run commands capable of performing system-wide updates (including global npm updates), so consider the privilege context (which user runs the cron) and whether updates should be limited or reviewed.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install xiaopi-auto-updater - After installation, invoke the skill by name or use
/xiaopi-auto-updater - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of the auto-updater skill:
- Sets up a daily cron job to automatically update Clawdbot and all installed skills.
- Notifies the user with a summary of updates applied or if all components are current.
- Supports configuration of update time, timezone, and message delivery options.
- Provides detailed instructions for setup, manual commands, troubleshooting, and disabling auto-updates.
- Compatible with Darwin and Linux operating systems.
Metadata
Frequently Asked Questions
What is Xiaopi Auto Updater?
Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... It is an AI Agent Skill for Claude Code / OpenClaw, with 104 downloads so far.
How do I install Xiaopi Auto Updater?
Run "/install xiaopi-auto-updater" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Xiaopi Auto Updater free?
Yes, Xiaopi Auto Updater is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Xiaopi Auto Updater support?
Xiaopi Auto Updater is cross-platform and runs anywhere OpenClaw / Claude Code is available (darwin, linux).
Who created Xiaopi Auto Updater?
It is built and maintained by Adin (@a-din); the current version is v1.0.0.
More Skills