Muguozi1 Openclaw Auto Updater

Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w...

This skill appears to do what it says (set up daily updates), but review and test before enabling automatic runs. Actions to take before installing/enabling: - Confirm provenance: the package metadata and registry header conflict (source unknown vs _meta.json claiming OpenClaw GitHub). Verify the repository URL and author outside the registry. - Inspect the auto-update script it would create (~/.clawdbot/scripts/auto-update.sh) and run it manually in dry-run mode first (SKILL.md suggests `clawdhub update --all --dry-run`). - Fix or confirm CLI names: docs mix 'clawhub' and 'clawdhub' and use 'clawdbot'; ensure the correct binaries exist on your system (run `which clawdbot`, `which clawdhub`/`clawhub`). The examples/scripts call 'clawhub' while docs call 'clawdhub' — this may be a typo that causes failures. - Check filesystem and permission implications: global package updates (npm -g / pnpm -g / bun) may require elevated privileges and can modify globally installed packages — ensure you understand and have backups or ways to rollback. - Run the commands manually or with `--dry-run` first to confirm expected output and that summaries/parsing are correct. - If you will enable automatic delivery to external providers (Telegram, etc.), ensure tokens/credentials are provided separately and securely; the skill does not declare or require them. Given the inconsistencies and the fact the skill runs system-level update commands, treat it as trusted only after manual verification and a successful dry-run. If you are uncertain about the origin, prefer manual update workflows instead of enabling automatic cron-based updates.

Type: OpenClaw Skill Name: muguozi1-openclaw-auto-updater Version: 1.0.0 The skill is designed to automate system-wide updates for the OpenClaw agent and its installed skills by setting up a daily cron job. It utilizes high-risk capabilities including shell execution for package managers (npm, pnpm, bun), system-level updates (clawdbot update), and automated configuration changes (clawdbot cron add). While these actions are explicitly aligned with the stated purpose of an auto-updater, the inherent risk of automated code execution and system modification via cron qualifies it as suspicious under the provided criteria, despite the lack of clear malicious intent or evidence of data exfiltration.