← 返回 Skills 市场

Clawdbot Release Check

Name: Clawdbot Release Check
Author: pors

作者 Mark Pors 🦖 · GitHub ↗ · v1.0.1

cross-platform ✓ 安全检测通过

2928

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawdbot-release-check

功能描述

Check for new clawdbot releases and notify once per new version.

使用说明 (SKILL.md)

Clawdbot Release Check

Checks for new clawdbot releases from GitHub and notifies you once per version. No nagging.

Installation

clawdhub install clawdbot-release-check

Quick Setup (with cron)

# Add daily update check at 9am, notify via Telegram
{baseDir}/scripts/setup.sh --telegram YOUR_TELEGRAM_ID

# Custom hour (e.g., 8am)
{baseDir}/scripts/setup.sh --hour 8 --telegram YOUR_TELEGRAM_ID

# Remove cron job
{baseDir}/scripts/setup.sh --uninstall

After setup, restart the gateway:

launchctl kickstart -k gui/$(id -u)/com.clawdis.gateway

Manual Usage

# Check for updates (silent if up-to-date or already notified)
{baseDir}/scripts/check.sh

# Show version info
{baseDir}/scripts/check.sh --status

# Force notification (bypass "already notified" state)
{baseDir}/scripts/check.sh --force

# Show highlights from ALL missed releases
{baseDir}/scripts/check.sh --all-highlights

# Clear state (will notify again on next check)
{baseDir}/scripts/check.sh --reset

# Help
{baseDir}/scripts/check.sh --help

How It Works

Fetches latest release from github.com/clawdbot/clawdbot/releases
Compares with your installed version (from package.json)
If behind, shows highlights from release notes
Saves state to prevent repeat notifications

Example Output

🔄 **Clawdbot Update Available!**

Current: `2.0.0-beta5`
Latest:  `2026.1.5-3`

_(3 versions behind)_

**Highlights:**
- Models: add image-specific model config
- Agent tools: new `image` tool
- Config: default model shorthands

🔗 https://github.com/clawdbot/clawdbot/releases/tag/v2026.1.5-3

To update: `cd /path/to/clawdis && git pull && pnpm install && pnpm build`

Files

State — ~/.clawdbot/clawdbot-release-check-state.json:

{
  "lastNotifiedVersion": "v2026.1.5-3",
  "lastCheckMs": 1704567890123
}

Cache — ~/.clawdbot/clawdbot-release-check-cache.json:

Release data cached for 24 hours (saves API calls)
Highlights extracted once per release (saves tokens)
Use --clear-cache to force refresh

Configuration

Environment variables:

CLAWDBOT_DIR — Path to clawdbot source (auto-detected from ~/dev/clawdis, ~/clawdbot, or npm global)
CACHE_MAX_AGE_HOURS — Cache TTL in hours (default: 24)

安全使用建议

This skill appears to be internally consistent and limited in scope, but review these points before installing: - Files written: the scripts write state and cache to ~/.clawdbot and add a cron/job entry at ~/.clawdbot/cron/jobs.json. If you want to remove it later, run setup.sh --uninstall and delete ~/.clawdbot. - Gateway delivery: setup.sh creates a job payload instructing your local gateway to run the check script and deliver any output to the configured channel (e.g., Telegram). Make sure you understand and trust the gateway process that will act on jobs.json, since it will forward the script output to external channels you select. - Undeclared tools: the scripts call npm (to auto-detect a global install) and uuidgen. The skill's metadata only declared curl and jq. Ensure those binaries exist (or set CLAWDBOT_DIR explicitly) to avoid runtime errors. - Platform note: SKILL.md references launchctl (macOS) for restarting the gateway — if you are not on macOS, the gateway restart instruction won't apply; nothing else is OS-restricted in the code, but behavior depends on the local environment. - Run manually first: before enabling the scheduled job, run scripts/check.sh --status (or --force) to inspect output and confirm it behaves as you expect. If you need higher assurance, inspect the scripts locally (they are small and included) and confirm your gateway trusts jobs.json only from your user account. If you see any unexpected remote endpoints (other than GitHub) in the future, do not install.

功能分析

Type: OpenClaw Skill Name: clawdbot-release-check Version: 1.0.1 The skill is designed to check for new clawdbot releases and notify the user. The `scripts/check.sh` script fetches release information from the official GitHub API (`https://api.github.com/repos/clawdbot/clawdbot/releases`) using `curl` and processes it locally with `jq`, `grep`, and `sed`. It stores state and cache files in `~/.clawdbot`. The `scripts/setup.sh` script creates a scheduled task (cron job) in `~/.clawdbot/cron/jobs.json` to run `check.sh` daily. The prompt-injection surface in `scripts/setup.sh`'s cron job payload (`message: "UPDATE_CHECK: Run ... and if there is output, send it to the user."`) is benign and directly aligns with the skill's stated purpose, without attempting to manipulate the agent for malicious actions. No evidence of data exfiltration, unauthorized execution, or other malicious intent was found.

能力评估

ℹ Purpose & Capability

The skill's name/description match the included scripts: it fetches releases from GitHub and notifies once per version. Minor inconsistencies: the scripts call npm (npm root -g) and uuidgen but the declared required binaries list only curl and jq; SKILL.md also suggests a macOS-specific restart command (launchctl) but the skill has no OS restriction declared. These are usability/information gaps rather than evidence of malicious behavior.

✓ Instruction Scope

Runtime instructions and scripts stay within the advertised scope: they call the GitHub releases API, compare against a local package.json, generate notification text, and store state/cache under ~/.clawdbot. setup.sh writes a jobs.json entry describing how a gateway should run the check and deliver output to a channel (telegram/whatsapp/discord). That behavior is consistent with the described notify-once-per-version purpose; note that setup trusts an external gateway process to read jobs.json and deliver output to the configured channel.

✓ Install Mechanism

This is an instruction-only skill with included shell scripts; there is no download or archive extraction. Nothing is pulled from arbitrary URLs during install. Risk is low from an install mechanism perspective.

✓ Credentials

The skill does not request secrets or credentials. It optionally accepts configuration env vars (CLAWDBOT_DIR, CACHE_MAX_AGE_HOURS) and setup requires you to pass a Telegram ID if you choose that channel. There are no unexplained credential requests.

✓ Persistence & Privilege

The skill writes files under the user's home directory (~/.clawdbot) and adds a job to that local jobs.json; it does not request always:true or modify global/system-wide skill settings. It does not alter other skills' configs. It does require that a gateway process read jobs.json to run scheduled checks and deliver messages — that is expected for its notify behavior.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawdbot-release-check
安装完成后，直接呼叫该 Skill 的名称或使用 /clawdbot-release-check 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Fix: Stay silent when running ahead of latest release (dev builds)

v1.0.0

Initial release of clawdbot-release-check. - Checks for new clawdbot releases on GitHub and notifies you once per new version. - Supports daily update checks via cron with Telegram notifications. - Includes commands to check status, force notification, show highlights from all missed releases, reset state, and display help. - Caches release data and highlights to reduce API calls and avoid repeated notifications. - Easily configurable via environment variables for source path and cache duration.

元数据

Slug clawdbot-release-check

版本 1.0.1

许可证 —

累计安装 18

当前安装数 16

历史版本数 2

常见问题