Openclaw Autoupdate

OpenClaw静默更新技能。安全自动化更新OpenClaw到最新版本。

This skill does perform exactly what an updater would: fetch a release from GitHub, install a DMG into /Applications, run a global npm install, and restart the OpenClaw gateway. That said, the package has quality issues and missing safeguards. Before installing or running it: 1) Inspect the script yourself and confirm the included SHA256 matches the shipped file. 2) Be aware the script will attempt to modify /Applications and run npm -g (may require sudo); do not run it as root without review. 3) Prefer updaters that verify release checksums or signatures — this script does not verify the downloaded DMG or npm package. 4) Confirm the GitHub release URL and the maintainer identity are legitimate; the SKILL.md/package.json/registry version mismatch is suspicious. 5) If you want lower risk, run the script manually rather than granting an agent autonomous invocation, or add integrity checks (curl the release checksum and validate) before permitting automated runs.

Type: OpenClaw Skill Name: openclaw-autoupdate Version: 1.0.6 The skill bundle is designed for updating the OpenClaw application and its CLI. The `scripts/silent-update.sh` script fetches version information and official releases from `api.github.com` and `github.com`, then uses standard system commands (`rm`, `cp`, `hdiutil`, `npm install -g`) to perform the update. All actions are consistent with the stated purpose of securely automating updates. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` to subvert the agent for harmful purposes. The script's actions, while requiring elevated privileges for installation, are legitimate for an update process and do not indicate malicious intent.